android/android_kernel_asus_sm8350
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
5c0a0fc81f
android_kernel_asus_sm8350/net/tipc
History
Ying Xue 5c0a0fc81f tipc: don't use memcpy to copy from user space 
tipc_msg_build() calls skb_copy_to_linear_data_offset() to copy data
from user space to kernel space. However, the latter function does
in its turn call memcpy() to perform the actual copying. This poses
an obvious security and robustness risk, since memcpy() never makes
any validity check on the pointer it is copying from.

To correct this, we the replace the offending function call with
a call to memcpy_fromiovecend(), which uses copy_from_user() to
perform the copying.

Signed-off-by: Ying Xue <ying.xue@windriver.com>
Reviewed-by: Paul Gortmaker <paul.gortmaker@windriver.com>
Signed-off-by: Jon Maloy <jon.maloy@ericsson.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2013-10-18 13:20:42 -04:00
..
addr.c tipc: compress out gratuitous extra carriage returns 2012-04-30 15:53:56 -04:00
addr.h tipc: compress out gratuitous extra carriage returns 2012-04-30 15:53:56 -04:00
bcast.c tipc: cosmetic realignment of function arguments 2013-06-17 15:53:01 -07:00
bcast.h tipc: cosmetic realignment of function arguments 2013-06-17 15:53:01 -07:00
bearer.c tipc: avoid possible deadlock while enable and disable bearer 2013-08-11 21:58:41 -07:00
bearer.h tipc: add InfiniBand media type 2013-04-17 14:18:33 -04:00
config.c tipc: convert config_lock from spinlock to mutex 2013-06-17 15:53:01 -07:00
config.h tipc: Optimize re-initialization of configuration service 2012-04-26 17:19:07 -04:00
core.c tipc: convert configuration server to use new server facility 2013-06-17 15:53:00 -07:00
core.h tipc: introduce new TIPC server infrastructure 2013-06-17 15:53:00 -07:00
discover.c tipc: cosmetic realignment of function arguments 2013-06-17 15:53:01 -07:00
discover.h tipc: rename struct link* to struct tipc_link* 2011-12-29 21:53:30 -05:00
eth_media.c tipc: remove dev_base_lock use from enable_bearer 2013-06-17 15:53:01 -07:00
handler.c tipc: do not use tasklet_disable before tasklet_kill 2012-11-03 15:10:14 -04:00
ib_media.c net/tipc: use %*phC to dump small buffers in hex form 2013-07-11 17:03:36 -07:00
Kconfig tipc: add InfiniBand media type 2013-04-17 14:18:33 -04:00
link.c tipc: fix wrong return value for link_send_sections_long routine 2013-06-17 15:53:01 -07:00
link.h tipc: remove the bearer congestion mechanism 2012-11-21 20:07:25 -05:00
log.c tipc: remove print_buf and deprecated log buffer code 2012-07-13 19:34:43 -04:00
Makefile tipc: introduce new TIPC server infrastructure 2013-06-17 15:53:00 -07:00
msg.c tipc: don't use memcpy to copy from user space 2013-10-18 13:20:42 -04:00
msg.h tipc: cosmetic realignment of function arguments 2013-06-17 15:53:01 -07:00
name_distr.c tipc: eliminate an unnecessary cast of node variable 2012-11-22 14:33:28 -05:00
name_distr.h [NET] TIPC: Fix whitespace errors. 2007-02-10 23:20:15 -08:00
name_table.c tipc: cosmetic realignment of function arguments 2013-06-17 15:53:01 -07:00
name_table.h tipc: cosmetic realignment of function arguments 2013-06-17 15:53:01 -07:00
net.c tipc: change tipc_net_start routine return value type 2012-08-20 02:26:30 -07:00
net.h tipc: change tipc_net_start routine return value type 2012-08-20 02:26:30 -07:00
netlink.c net-next: replace obsolete NLMSG_* with type safe nlmsg_* 2013-03-28 14:25:25 -04:00
node_subscr.c tipc: cosmetic realignment of function arguments 2013-06-17 15:53:01 -07:00
node_subscr.h tipc: compress out gratuitous extra carriage returns 2012-04-30 15:53:56 -04:00
node.c hlist: drop the node parameter from iterators 2013-02-27 19:10:24 -08:00
node.h tipc: rename supported flag to recv_permitted 2012-11-22 07:50:51 -05:00
port.c tipc: cosmetic realignment of function arguments 2013-06-17 15:53:01 -07:00
port.h tipc: cosmetic realignment of function arguments 2013-06-17 15:53:01 -07:00
ref.c tipc: use standard printk shortcut macros (pr_err etc.) 2012-07-13 19:24:44 -04:00
ref.h tipc: cleanup function namespace 2010-10-16 11:13:24 -07:00
server.c tipc: fix oops when creating server socket fails 2013-08-01 15:54:33 -07:00
server.h tipc: introduce new TIPC server infrastructure 2013-06-17 15:53:00 -07:00
socket.c tipc: set sk_err correctly when connection fails 2013-08-30 16:06:57 -04:00
subscr.c tipc: cosmetic realignment of function arguments 2013-06-17 15:53:01 -07:00
subscr.h tipc: cosmetic realignment of function arguments 2013-06-17 15:53:01 -07:00
sysctl.c tipc: change socket buffer overflow control to respect sk_rcvbuf 2013-06-17 15:53:00 -07:00