linux/net/nfc
David S. Miller 676d23690f net: Fix use after free by removing length arg from sk_data_ready callbacks.
Several spots in the kernel perform a sequence like:

	skb_queue_tail(&sk->s_receive_queue, skb);
	sk->sk_data_ready(sk, skb->len);

But at the moment we place the SKB onto the socket receive queue it
can be consumed and freed up.  So this skb->len access is potentially
to freed up memory.

Furthermore, the skb->len can be modified by the consumer so it is
possible that the value isn't accurate.

And finally, no actual implementation of this callback actually uses
the length argument.  And since nobody actually cared about it's
value, lots of call sites pass arbitrary values in such as '0' and
even '1'.

So just remove the length argument from the callback, that way there
is no confusion whatsoever and all of these use-after-free cases get
fixed as a side effect.

Based upon a patch by Eric Dumazet and his suggestion to audit this
issue tree-wide.

Signed-off-by: David S. Miller <davem@davemloft.net>
2014-04-11 16:15:36 -04:00
..
hci NFC: Use LIST_HEAD() at appropriate places 2014-02-23 23:34:09 +01:00
nci NFC: 3.15: First pull request 2014-03-17 13:16:50 -04:00
Kconfig NFC Digital: Add NFC-F technology support 2013-09-25 02:02:25 +02:00
Makefile NFC Digital: Add initiator NFC-DEP support 2013-09-25 02:02:27 +02:00
af_nfc.c nfc: Fix FSF address in file headers 2013-12-11 10:56:21 -05:00
core.c NFC: Move checking valid gb_len value to nfc_llcp_set_remote_gb 2014-03-14 20:19:08 +01:00
digital.h NFC: digital: Add ISO-DEP support for data exchange 2014-02-16 23:49:54 +01:00
digital_core.c NFC: digital: Rename Type V tags to Type 5 tags 2014-03-11 00:40:59 +01:00
digital_dep.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next 2014-01-25 11:17:34 -08:00
digital_technology.c NFC: digital: Add ISO-DEP support for data exchange 2014-02-16 23:49:54 +01:00
llcp.h nfc: Fix FSF address in file headers 2013-12-11 10:56:21 -05:00
llcp_commands.c NFC: llcp: Use default MIU if none was specified on connect 2014-01-04 03:32:27 +01:00
llcp_core.c net: Fix use after free by removing length arg from sk_data_ready callbacks. 2014-04-11 16:15:36 -04:00
llcp_sock.c net: add build-time checks for msg->msg_name size 2014-01-18 23:04:16 -08:00
netlink.c NFC: Add netlink support for ISO/IEC 15693 2014-02-16 23:49:53 +01:00
nfc.h nfc: Fix FSF address in file headers 2013-12-11 10:56:21 -05:00
rawsock.c nfc: Fix FSF address in file headers 2013-12-11 10:56:21 -05:00