Erik Hugne d7bb74c38c tipc: fix out of bounds indexing ...

Commit 78acb1f9b8 ("tipc: add
ioctl to fetch link names") introduced a buffer overflow bug where
specially crafted ioctl requests could cause out-of-bounds indexing
of the node->links array. This was caused by an incorrect check vs
MAX_BEARERS, and the static code checker complaint is:
net/tipc/node.c:459 tipc_node_get_linkname() error: buffer overflow 'node->links' 2 <= 2

Signed-off-by: Erik Hugne <erik.hugne@ericsson.com>
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

2014-04-28 14:43:35 -04:00

..

addr.c

…

addr.h

…

bcast.c

tipc: use bc_lock to protect node map in bearer structure

2014-04-22 21:17:53 -04:00

bcast.h

tipc: use bc_lock to protect node map in bearer structure

2014-04-22 21:17:53 -04:00

bearer.c

tipc: fix race in disc create/delete

2014-04-22 21:17:53 -04:00

bearer.h

tipc: use RCU to protect media_ptr pointer

2014-04-22 21:17:53 -04:00

config.c

tipc: replace config_mutex lock with RTNL lock

2014-04-22 21:17:52 -04:00

config.h

tipc: obsolete the remote management feature

2014-03-27 13:08:36 -04:00

core.c

tipc: obsolete the remote management feature

2014-03-27 13:08:36 -04:00

core.h

tipc: replace config_mutex lock with RTNL lock

2014-04-22 21:17:52 -04:00

discover.c

tipc: fix a possible memory leak

2014-04-27 19:08:06 -04:00

discover.h

tipc: fix race in disc create/delete

2014-04-22 21:17:53 -04:00

eth_media.c

…

handler.c

tipc: don't log disabled tasklet handler errors

2014-03-06 14:46:24 -05:00

ib_media.c

…

Kconfig

…

link.c

tipc: purge tipc_net_lock lock

2014-04-22 21:17:53 -04:00

link.h

tipc: decouple the relationship between bearer and link

2014-04-22 21:17:53 -04:00

log.c

…

Makefile

…

msg.c

…

msg.h

…

name_distr.c

tipc: purge tipc_net_lock lock

2014-04-22 21:17:53 -04:00

name_distr.h

tipc: align tipc function names with common naming practice in the network

2014-02-18 17:31:59 -05:00

name_table.c

tipc: fix memory leak during module removal

2014-03-06 14:46:24 -05:00

name_table.h

…

net.c

tipc: purge tipc_net_lock lock

2014-04-22 21:17:53 -04:00

net.h

tipc: purge tipc_net_lock lock

2014-04-22 21:17:53 -04:00

netlink.c

tipc: remove all enabled flags from all tipc components

2014-02-22 00:00:15 -05:00

node_subscr.c

…

node_subscr.h

…

node.c

tipc: fix out of bounds indexing

2014-04-28 14:43:35 -04:00

node.h

tipc: add ioctl to fetch link names

2014-04-26 12:13:24 -04:00

port.c

tipc: eliminate redundant lookups in registry

2014-03-12 15:53:49 -04:00

port.h

tipc: eliminate redundant lookups in registry

2014-03-12 15:53:49 -04:00

ref.c

tipc: eliminate redundant lookups in registry

2014-03-12 15:53:49 -04:00

ref.h

tipc: eliminate redundant lookups in registry

2014-03-12 15:53:49 -04:00

server.c

net: Fix use after free by removing length arg from sk_data_ready callbacks.

2014-04-11 16:15:36 -04:00

server.h

tipc: remove all enabled flags from all tipc components

2014-02-22 00:00:15 -05:00

socket.c

tipc: add ioctl to fetch link names

2014-04-26 12:13:24 -04:00

socket.h

tipc: align usage of variable names and macros in socket

2014-03-12 15:53:49 -04:00

subscr.c

tipc: fix spinlock recursion bug for failed subscriptions

2014-03-24 15:36:56 -04:00

subscr.h

…

sysctl.c

…