Dan Rosenberg fdac1e0697 irda: prevent integer underflow in IRLMP_ENUMDEVICES ...

If the user-provided len is less than the expected offset, the
IRLMP_ENUMDEVICES getsockopt will do a copy_to_user() with a very large
size value.  While this isn't be a security issue on x86 because it will
get caught by the access_ok() check, it may leak large amounts of kernel
heap on other architectures.  In any event, this patch fixes it.

Signed-off-by: Dan Rosenberg <drosenberg@vsecurity.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

2010-12-23 10:09:43 -08:00

..

ircomm

net: return operator cleanup

2010-09-23 14:33:39 -07:00

irlan

net/irda: Use static const char * const where possible

2010-09-14 20:22:05 -07:00

irnet

Merge branch 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial

2010-10-24 13:41:39 -07:00

af_irda.c

irda: prevent integer underflow in IRLMP_ENUMDEVICES

2010-12-23 10:09:43 -08:00

discovery.c

net: return operator cleanup

2010-09-23 14:33:39 -07:00

irda_device.c

include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h

2010-03-30 22:02:32 +09:00

iriap_event.c

include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h

2010-03-30 22:02:32 +09:00

iriap.c

irda: Fix heap memory corruption in iriap.c

2010-10-11 02:12:26 +02:00

irias_object.c

include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h

2010-03-30 22:02:32 +09:00

irlap_event.c

include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h

2010-03-30 22:02:32 +09:00

irlap_frame.c

include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h

2010-03-30 22:02:32 +09:00

irlap.c

tree-wide: fix assorted typos all over the place

2009-12-04 15:39:55 +01:00

irlmp_event.c

net: mark read-only arrays as const

2009-08-05 10:42:58 -07:00

irlmp_frame.c

net: return operator cleanup

2010-09-23 14:33:39 -07:00

irlmp.c

net: return operator cleanup

2010-09-23 14:33:39 -07:00

irmod.c

net: convert usage of packet_type to read_mostly

2009-03-10 05:22:43 -07:00

irnetlink.c

include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h

2010-03-30 22:02:32 +09:00

irproc.c

net: file_operations should be const

2009-09-02 01:03:53 -07:00

irqueue.c

include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h

2010-03-30 22:02:32 +09:00

irsysctl.c

sysctl net: Remove unused binary sysctl code

2009-11-12 02:05:06 -08:00

irttp.c

net: irda: irttp: sync error paths of data- and udata-requests

2010-11-18 12:24:25 -08:00

Kconfig

…

Makefile

…

parameters.c

irda: Fix parameter extraction stack overflow

2010-10-11 02:12:17 +02:00

qos.c

net: replace remaining __FUNCTION__ occurrences

2008-03-05 20:47:47 -08:00

timer.c

net: Make static

2008-12-10 15:18:31 -08:00

wrapper.c

net: replace remaining __FUNCTION__ occurrences

2008-03-05 20:47:47 -08:00