You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

Cong Wang f991af3daa mqueue: fix a use-after-free in sys_mq_notify() ... The retry logic for netlink_attachskb() inside sys_mq_notify() is nasty and vulnerable: 1) The sock refcnt is already released when retry is needed 2) The fd is controllable by user-space because we already release the file refcnt so we when retry but the fd has been just closed by user-space during this small window, we end up calling netlink_detachskb() on the error path which releases the sock again, later when the user-space closes this socket a use-after-free could be triggered. Setting 'sock' to NULL here should be sufficient to fix it. Reported-by: GeneBlue <geneblue.mail@gmail.com> Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com> Cc: Andrew Morton <akpm@linux-foundation.org> Cc: Manfred Spraul <manfred@colorfullife.com> Cc: stable@kernel.org Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>		8 years ago
..
Makefile	mqueue: move compat syscalls to native ones	8 years ago
compat.c	…
ipc_sysctl.c	…
mq_sysctl.c	…
mqueue.c	mqueue: fix a use-after-free in sys_mq_notify()	8 years ago
msg.c	sched/headers: Move the wake-queue types and interfaces from sched.h into <linux/sched/wake_q.h>	8 years ago
msgutil.c	ipc: account for kmem usage on mqueue and msg	8 years ago
namespace.c	sched/headers: Prepare to move the task_lock()/unlock() APIs to <linux/sched/task.h>	8 years ago
sem.c	sched/headers: Prepare for new header dependencies before moving code to <linux/sched/wake_q.h>	8 years ago
shm.c	fs: remove call_fsync helper function	8 years ago
syscall.c	…
util.c	mm: introduce kv[mz]alloc helpers	8 years ago
util.h	ipc: Remove unused declaration of recompute_msgmni	8 years ago