diff mbox series

[4.4,09/85] net: add __must_check to skb_put_padto()

Message ID	20200929105928.681246288@linuxfoundation.org
State	New
Headers	show Return-Path: <SRS0=j5F6=DG=vger.kernel.org=stable-owner@kernel.org> From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org, Eric Dumazet <edumazet@google.com>, "David S. Miller" <davem@davemloft.net> Subject: [PATCH 4.4 09/85] net: add __must_check to skb_put_padto() Date: Tue, 29 Sep 2020 12:59:36 +0200 Message-Id: <20200929105928.681246288@linuxfoundation.org> In-Reply-To: <20200929105928.198942536@linuxfoundation.org> References: <20200929105928.198942536@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk
Series	None \| expand [4.4,02/85] KVM: fix memory leak in kvm_io_bus_unregister_dev() [4.4,03/85] kprobes: fix kill kprobe which has been marked as gone [4.4,04/85] ftrace: Setup correct FTRACE_FL_REGS flags for module [4.4,05/85] RDMA/ucma: ucma_context reference leak in error path [4.4,06/85] mtd: Fix comparison in map_word_andequal() [4.4,07/85] hdlc_ppp: add range checks in ppp_cp_parse_cr() [4.4,08/85] tipc: use skb_unshare() instead in tipc_buf_append() [4.4,09/85] net: add __must_check to skb_put_padto() [4.4,10/85] ip: fix tos reflection in ack and reset packets [4.4,11/85] serial: 8250: Avoid error message on reprobe [4.4,12/85] scsi: aacraid: fix illegal IO beyond last LBA [4.4,13/85] m68k: q40: Fix info-leak in rtc_ioctl [4.4,14/85] gma/gma500: fix a memory disclosure bug due to uninitialized bytes [4.4,15/85] ASoC: kirkwood: fix IRQ error handling [4.4,16/85] PM / devfreq: tegra30: Fix integer overflow on CPUs freq max out [4.4,17/85] mtd: cfi_cmdset_0002: dont free cfi->cfiq in error path of cfi_amdstd_setup() [4.4,18/85] mfd: mfd-core: Protect against NULL call-back function pointer [4.4,19/85] tracing: Adding NULL checks for trace_array descriptor pointer [4.4,20/85] bcache: fix a lost wake-up problem caused by mca_cannibalize_lock [4.4,21/85] xfs: fix attr leaf header freemap.size underflow [4.4,22/85] kernel/sys.c: avoid copying possible padding bytes in copy_to_user [4.4,23/85] neigh_stat_seq_next() should increase position index [4.4,24/85] rt_cpu_seq_next should increase position index [4.4,25/85] seqlock: Require WRITE_ONCE surrounding raw_seqcount_barrier [4.4,26/85] ACPI: EC: Reference count query handlers under lock [4.4,27/85] tracing: Set kernel_stacks caller size properly [4.4,28/85] ar5523: Add USB ID of SMCWUSBT-G2 wireless adapter [4.4,29/85] Bluetooth: Fix refcount use-after-free issue [4.4,30/85] mm: pagewalk: fix termination condition in walk_pte_range() [4.4,31/85] Bluetooth: prefetch channel before killing sock [4.4,32/85] skbuff: fix a data race in skb_queue_len() [4.4,33/85] audit: CONFIG_CHANGE dont log internal bookkeeping as an event [4.4,34/85] selinux: sel_avc_get_stat_idx should increase position index [4.4,35/85] scsi: lpfc: Fix RQ buffer leakage when no IOCBs available [4.4,36/85] drm/omap: fix possible object reference leak [4.4,37/85] dmaengine: tegra-apb: Prevent race conditions on channels freeing [4.4,38/85] media: go7007: Fix URB type for interrupt handling [4.4,39/85] Bluetooth: guard against controllers sending zerod events [4.4,40/85] drm/amdgpu: increase atombios cmd timeout [4.4,41/85] Bluetooth: L2CAP: handle l2cap config request during open state [4.4,42/85] media: tda10071: fix unsigned sign extension overflow [4.4,43/85] tpm: ibmvtpm: Wait for buffer to be set before proceeding [4.4,44/85] tracing: Use address-of operator on section symbols [4.4,45/85] serial: 8250_omap: Fix sleeping function called from invalid context during probe [4.4,46/85] SUNRPC: Fix a potential buffer overflow in svc_print_xprts() [4.4,47/85] ubifs: Fix out-of-bounds memory access caused by abnormal value of node_len [4.4,48/85] ALSA: usb-audio: Fix case when USB MIDI interface has more than one extra endpoint de... [4.4,49/85] mm/filemap.c: clear page error before actual read [4.4,50/85] mm/mmap.c: initialize align_offset explicitly for vm_unmapped_area [4.4,51/85] KVM: Remove CREATE_IRQCHIP/SET_PIT2 race [4.4,52/85] bdev: Reduce time holding bd_mutex in sync in blkdev_close() [4.4,53/85] drivers: char: tlclk.c: Avoid data race between init and interrupt handler [4.4,54/85] dt-bindings: sound: wm8994: Correct required supplies based on actual implementaion [4.4,55/85] atm: fix a memory leak of vcc->user_back [4.4,56/85] phy: samsung: s5pv210-usb2: Add delay after reset [4.4,57/85] Bluetooth: Handle Inquiry Cancel error after Inquiry Complete [4.4,58/85] USB: EHCI: ehci-mv: fix error handling in mv_ehci_probe() [4.4,59/85] tty: serial: samsung: Correct clock selection logic [4.4,60/85] ALSA: hda: Fix potential race in unsol event handler [4.4,61/85] fuse: dont check refcount after stealing page [4.4,62/85] USB: EHCI: ehci-mv: fix less than zero comparison of an unsigned int [4.4,63/85] e1000: Do not perform reset in reset_task if we are already down [4.4,64/85] printk: handle blank console arguments passed in. [4.4,65/85] vfio/pci: fix memory leaks of eventfd ctx [4.4,66/85] perf kcore_copy: Fix module map when there are no modules loaded [4.4,67/85] mtd: rawnand: omap_elm: Fix runtime PM imbalance on error [4.4,68/85] ceph: fix potential race in ceph_check_caps [4.4,69/85] mtd: parser: cmdline: Support MTD names containing one or more colons [4.4,70/85] x86/speculation/mds: Mark mds_user_clear_cpu_buffers() __always_inline [4.4,71/85] vfio/pci: Clear error and request eventfd ctx after releasing [4.4,72/85] vfio/pci: fix racy on error and request eventfd ctx [4.4,73/85] s390/init: add missing __init annotations [4.4,74/85] mwifiex: Increase AES key storage size to 256 bits [4.4,75/85] batman-adv: bla: fix type misuse for backbone_gw hash indexing [4.4,76/85] atm: eni: fix the missed pci_disable_device() for eni_init_one() [4.4,77/85] batman-adv: mcast/TT: fix wrongly dropped or rerouted packets [4.4,78/85] ALSA: asihpi: fix iounmap in error handler [4.4,79/85] MIPS: Add the missing CPU_1074K into __get_cpu_type() [4.4,80/85] tty: vt, consw->con_scrolldelta cleanup [4.4,81/85] kprobes: Fix to check probe enabled before disarm_kprobe_ftrace() [4.4,82/85] lib/string.c: implement stpcpy [4.4,83/85] ata: define AC_ERR_OK [4.4,84/85] ata: make qc_prep return ata_completion_errors [4.4,85/85] ata: sata_mv, avoid trigerrable BUG_ON

Commit Message

Greg KH Sept. 29, 2020, 10:59 a.m. UTC

From: Eric Dumazet <edumazet@google.com>

[ Upstream commit 4a009cb04aeca0de60b73f37b102573354214b52 ]

skb_put_padto() and __skb_put_padto() callers
must check return values or risk use-after-free.

Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/linux/skbuff.h |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff mbox series

Patch

--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -2651,7 +2651,7 @@  static inline int skb_padto(struct sk_bu
  *	is untouched. Otherwise it is extended. Returns zero on
  *	success. The skb is freed on error.
  */
-static inline int skb_put_padto(struct sk_buff *skb, unsigned int len)
+static inline int __must_check skb_put_padto(struct sk_buff *skb, unsigned int len)
 {
 	unsigned int size = skb->len;