c76c5f058f
This is a snapshot of the sockev module taken as of msm-4.4
commit 33193859886dd87 ("net: core: Send only BIND and LISTEN events.").
Added module which subscribes to socket notifier events. Notifier events
are then converted to a multicast netlink message for user space
applications to consume.
net: core: null pointer derefernce in sockev_client_cb
sockev_client_cb creates a netlink message and populates
the nlmsg_data using the socket->sock information.
If socket is closed, while the nlmsg_data is being
populated, a null pointer dereference occurs.
BUG: KASAN: null-ptr-deref in sockev_client_cb+0x1e4/0x310 net/core/sockev_nlmcast.c:98
Read of size 2 at addr 0000000000000010 by task syz-executor/9398
CPU: 6 PID: 9398 Comm: syz-executor Tainted: G W O 4.9.92+ #1
Call trace:
[<ffffff94e2bebec4>] sockev_client_cb+0x1e4/0x310 net/core/sockev_nlmcast.c:98
[<ffffff94e14fb20c>] notifier_call_chain+0x94/0xe0 kernel/notifier.c:93
[<ffffff94e14fb894>] __blocking_notifier_call_chain+0x6c/0xb8 kernel/notifier.c:317
[<ffffff94e14fb920>] blocking_notifier_call_chain+0x40/0x50 kernel/notifier.c:328
[<ffffff94e2b727f8>] sockev_notify net/socket.c:180 [inline]
[<ffffff94e2b727f8>] SYSC_listen net/socket.c:1446 [inline]
[<ffffff94e2b727f8>] SyS_listen+0x1e0/0x1f8 net/socket.c:1428
[<ffffff94e1483f70>] el0_svc_naked+0x24/0x28
net: sockev: fix uninitialized data leak into userspace
Socket event string, notifying userspace of socket event, can leak
data into userspace. Memset it before filling it using strlcpy.
net: memset smsg to avoid the padding data
memset smsg to avoid the padding data of kernel to be shared
with user space. Fix is to set fields event to all "0", but there is
actually 6 bytes padding between "sktype" and "skflags", so memset was
done to set all the padding bits to 0.
CRs-Fixed: 1078373
Change-Id: I435486b80ad19c5fa54b098680623e7a4f080198
Acked-by: Manoj Basapathi <manojbm@qti.qualcomm.com>
Signed-off-by: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>
Signed-off-by: Tejaswi Tanikella <tejaswit@codeaurora.org>
Signed-off-by: Sauvik Saha <ssaha@codeaurora.org>
36 lines
1.3 KiB
Makefile
36 lines
1.3 KiB
Makefile
# SPDX-License-Identifier: GPL-2.0
|
|
#
|
|
# Makefile for the Linux networking core.
|
|
#
|
|
|
|
obj-y := sock.o request_sock.o skbuff.o datagram.o stream.o scm.o \
|
|
gen_stats.o gen_estimator.o net_namespace.o secure_seq.o flow_dissector.o
|
|
|
|
obj-$(CONFIG_SYSCTL) += sysctl_net_core.o
|
|
|
|
obj-y += dev.o ethtool.o dev_addr_lists.o dst.o netevent.o \
|
|
neighbour.o rtnetlink.o utils.o link_watch.o filter.o \
|
|
sock_diag.o dev_ioctl.o tso.o sock_reuseport.o \
|
|
fib_notifier.o xdp.o
|
|
|
|
obj-y += net-sysfs.o
|
|
obj-$(CONFIG_PAGE_POOL) += page_pool.o
|
|
obj-$(CONFIG_PROC_FS) += net-procfs.o
|
|
obj-$(CONFIG_NET_PKTGEN) += pktgen.o
|
|
obj-$(CONFIG_NETPOLL) += netpoll.o
|
|
obj-$(CONFIG_FIB_RULES) += fib_rules.o
|
|
obj-$(CONFIG_TRACEPOINTS) += net-traces.o
|
|
obj-$(CONFIG_NET_DROP_MONITOR) += drop_monitor.o
|
|
obj-$(CONFIG_NETWORK_PHY_TIMESTAMPING) += timestamping.o
|
|
obj-$(CONFIG_NET_PTP_CLASSIFY) += ptp_classifier.o
|
|
obj-$(CONFIG_CGROUP_NET_PRIO) += netprio_cgroup.o
|
|
obj-$(CONFIG_CGROUP_NET_CLASSID) += netclassid_cgroup.o
|
|
obj-$(CONFIG_LWTUNNEL) += lwtunnel.o
|
|
obj-$(CONFIG_LWTUNNEL_BPF) += lwt_bpf.o
|
|
obj-$(CONFIG_SOCKEV_NLMCAST) += sockev_nlmcast.o
|
|
obj-$(CONFIG_DST_CACHE) += dst_cache.o
|
|
obj-$(CONFIG_HWBM) += hwbm.o
|
|
obj-$(CONFIG_NET_DEVLINK) += devlink.o
|
|
obj-$(CONFIG_GRO_CELLS) += gro_cells.o
|
|
obj-$(CONFIG_FAILOVER) += failover.o
|