Rainer Weikusat a5527dda34 af_unix: Guard against other == sk in unix_dgram_sendmsg ... The unix_dgram_sendmsg routine use the following test if (unlikely(unix_peer(other) != sk && unix_recvq_full(other))) { to determine if sk and other are in an n:1 association (either established via connect or by using sendto to send messages to an unrelated socket identified by address). This isn't correct as the specified address could have been bound to the sending socket itself or because this socket could have been connected to itself by the time of the unix_peer_get but disconnected before the unix_state_lock(other). In both cases, the if-block would be entered despite other == sk which might either block the sender unintentionally or lead to trying to unlock the same spin lock twice for a non-blocking send. Add a other != sk check to guard against this. Fixes: 7d267278a9 ("unix: avoid use-after-free in ep_remove_wait_queue") Reported-By: Philipp Hahn <pmhahn@pmhahn.de> Signed-off-by: Rainer Weikusat <rweikusat@mobileactivedefense.com> Tested-by: Philipp Hahn <pmhahn@pmhahn.de> Signed-off-by: David S. Miller <davem@davemloft.net>		2016-02-16 12:53:35 -05:00
..
6lowpan	6lowpan: fix debugfs interface entry name	2015-12-20 08:21:00 +01:00
9p	Rework and error handling fixes, primarily in the fscatch and fd transports.	2016-01-24 12:39:09 -08:00
802
8021q	net: Rename NETIF_F_ALL_CSUM to NETIF_F_CSUM_MASK	2015-12-15 16:50:08 -05:00
appletalk
atm	net: Generalise wq_has_sleeper helper	2015-11-30 14:47:33 -05:00
ax25	net: add validation for the socket syscall protocol argument	2015-12-14 16:09:30 -05:00
batman-adv	batman-adv: Drop immediate orig_node free function	2016-01-16 22:50:00 +08:00
bluetooth	Bluetooth: Fix incorrect removing of IRKs	2016-01-29 11:47:24 +01:00
bridge	switchdev: Require RTNL mutex to be held when sending FDB notifications	2016-01-28 16:21:31 -08:00
caif	net: rename SOCK_ASYNC_NOSPACE and SOCK_ASYNC_WAITDATA	2015-12-01 15:45:05 -05:00
can	can: avoid using timeval for uapi	2015-10-13 17:42:34 +02:00
ceph	libceph: MOSDOpReply v7 encoding	2016-02-04 18:26:08 +01:00
core	flow_dissector: Fix unaligned access in __skb_flow_dissector when used by eth_get_headlen	2016-02-09 07:07:48 -05:00
dcb	net/dcb: make dcbnl.c explicitly non-modular	2015-10-09 07:52:27 -07:00
dccp	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2015-12-03 21:09:12 -05:00
decnet	net: add validation for the socket syscall protocol argument	2015-12-14 16:09:30 -05:00
dns_resolver	net: dns_resolver: convert time_t to time64_t	2015-11-18 16:27:46 -05:00
dsa	dsa: Register netdev before phy	2016-01-07 14:31:26 -05:00
ethernet	net: Add eth_platform_get_mac_address() helper.	2016-01-06 16:31:56 -05:00
hsr	net/hsr: fix a warning message	2015-11-23 14:56:15 -05:00
ieee802154	inet: kill unused skb_free op	2016-01-05 22:25:57 -05:00
ipv4	ipv4: fix memory leaks in ip_cmsg_send() callers	2016-02-13 05:57:39 -05:00
ipv6	tcp: do not drop syn_recv on all icmp reports	2016-02-09 04:15:37 -05:00
ipx
irda	irda: fix a potential use-after-free in ircomm_param_request	2016-01-29 22:56:46 -08:00
iucv	af_iucv: Validate socket address length in iucv_sock_bind()	2016-01-19 14:21:08 -05:00
key	af_key: fix two typos	2015-10-23 03:05:19 -07:00
l2tp	l2tp: rely on ppp layer for skb scrubbing	2016-01-04 16:45:24 -05:00
l3mdev	net: Add netif_is_l3_slave	2015-10-07 04:27:43 -07:00
lapb
llc	tcp: fix recv with flags MSG_WAITALL | MSG_PEEK	2015-07-27 01:06:53 -07:00
mac80211	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2016-02-01 15:56:08 -08:00
mac802154	mac802154: constify ieee802154_llsec_ops structure	2016-01-04 20:40:41 +01:00
mpls	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2015-12-17 22:08:28 -05:00
netfilter	netfilter: nf_conntrack: use safer way to lock all buckets	2016-01-20 14:15:31 +01:00
netlabel
netlink	netlink: not trim skb for mmaped socket when dump	2016-01-29 20:25:17 -08:00
netrom
nfc	NFC 4.5 pull request	2016-01-04 21:48:15 -05:00
openvswitch	vxlan, gre, geneve: Set a large MTU on ovs-created tunnel devices	2016-02-10 05:50:03 -05:00
packet	packet: Allow packets with only a header (but no payload)	2015-11-29 22:17:17 -05:00
phonet	phonet: properly unshare skbs in phonet_rcv()	2016-01-12 12:05:38 -05:00
rds	Initial roundup of 4.5 merge window patches	2016-01-23 18:45:06 -08:00
rfkill	rfkill: fix rfkill_fop_read wait_event usage	2016-01-26 11:32:05 +01:00
rose
rxrpc	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next	2016-01-12 18:57:02 -08:00
sched	net_sched: drr: check for NULL pointer in drr_dequeue	2016-01-29 17:26:44 -08:00
sctp	sctp: translate network order to host order when users get a hmacid	2016-02-09 04:53:16 -05:00
sunrpc	Initial roundup of 4.5 merge window patches	2016-01-23 18:45:06 -08:00
switchdev	switchdev: Require RTNL mutex to be held when sending FDB notifications	2016-01-28 16:21:31 -08:00
tipc	tipc: fix connection abort during subscription cancel	2016-01-29 15:14:21 -05:00
unix	af_unix: Guard against other == sk in unix_dgram_sendmsg	2016-02-16 12:53:35 -05:00
vmw_vsock	vsock: Fix blocking ops call in prepare_to_wait	2016-02-13 05:57:39 -05:00
wimax	net:wimax: Fix doucble word "the the" in networking.xml	2015-08-09 22:43:52 -07:00
wireless	regulatory: fix world regulatory domain data	2016-01-14 11:10:13 +01:00
x25
xfrm	net: preserve IP control block during GSO segmentation	2016-01-15 14:35:24 -05:00
compat.c
Kconfig	net, sched: add clsact qdisc	2016-01-10 22:13:15 -05:00
Makefile	net: Introduce L3 Master device abstraction	2015-09-29 20:40:32 -07:00
socket.c	kmemcg: account certain kmem allocations to memcg	2016-01-14 16:00:49 -08:00
sysctl_net.c	net: sysctl: fix a kmemleak warning	2015-10-23 06:22:08 -07:00