diff mbox series

[4.9,012/121] net: add __must_check to skb_put_padto()

Message ID	20200929105930.790779331@linuxfoundation.org
State	Superseded
Headers	show Return-Path: <SRS0=j5F6=DG=vger.kernel.org=stable-owner@kernel.org> From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org, Eric Dumazet <edumazet@google.com>, "David S. Miller" <davem@davemloft.net> Subject: [PATCH 4.9 012/121] net: add __must_check to skb_put_padto() Date: Tue, 29 Sep 2020 12:59:16 +0200 Message-Id: <20200929105930.790779331@linuxfoundation.org> In-Reply-To: <20200929105930.172747117@linuxfoundation.org> References: <20200929105930.172747117@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk
Series	None \| expand [4.9,002/121] KVM: fix memory leak in kvm_io_bus_unregister_dev() [4.9,003/121] kprobes: fix kill kprobe which has been marked as gone [4.9,004/121] RDMA/ucma: ucma_context reference leak in error path [4.9,005/121] mtd: Fix comparison in map_word_andequal() [4.9,006/121] hdlc_ppp: add range checks in ppp_cp_parse_cr() [4.9,007/121] ip: fix tos reflection in ack and reset packets [4.9,008/121] tipc: use skb_unshare() instead in tipc_buf_append() [4.9,009/121] bnxt_en: Protect bnxt_set_eee() and bnxt_set_pauseparam() with mutex. [4.9,010/121] net: phy: Avoid NPD upon phy_detach() when driver is unbound [4.9,011/121] net/hsr: Check skb_put_padto() return value [4.9,012/121] net: add __must_check to skb_put_padto() [4.9,013/121] serial: 8250: Avoid error message on reprobe [4.9,014/121] scsi: aacraid: fix illegal IO beyond last LBA [4.9,015/121] m68k: q40: Fix info-leak in rtc_ioctl [4.9,016/121] gma/gma500: fix a memory disclosure bug due to uninitialized bytes [4.9,017/121] ASoC: kirkwood: fix IRQ error handling [4.9,018/121] ALSA: usb-audio: Add delay quirk for H570e USB headsets [4.9,019/121] PM / devfreq: tegra30: Fix integer overflow on CPUs freq max out [4.9,020/121] clk/ti/adpll: allocate room for terminating null [4.9,021/121] mtd: cfi_cmdset_0002: dont free cfi->cfiq in error path of cfi_amdstd_setup() [4.9,022/121] mfd: mfd-core: Protect against NULL call-back function pointer [4.9,023/121] tracing: Adding NULL checks for trace_array descriptor pointer [4.9,024/121] bcache: fix a lost wake-up problem caused by mca_cannibalize_lock [4.9,025/121] RDMA/i40iw: Fix potential use after free [4.9,026/121] xfs: fix attr leaf header freemap.size underflow [4.9,027/121] RDMA/iw_cgxb4: Fix an error handling path in c4iw_connect() [4.9,028/121] debugfs: Fix !DEBUG_FS debugfs_create_automount [4.9,029/121] CIFS: Properly process SMB3 lease breaks [4.9,030/121] kernel/sys.c: avoid copying possible padding bytes in copy_to_user [4.9,031/121] neigh_stat_seq_next() should increase position index [4.9,032/121] rt_cpu_seq_next should increase position index [4.9,033/121] seqlock: Require WRITE_ONCE surrounding raw_seqcount_barrier [4.9,034/121] media: ti-vpe: cal: Restrict DMA to avoid memory corruption [4.9,035/121] ACPI: EC: Reference count query handlers under lock [4.9,036/121] dmaengine: zynqmp_dma: fix burst length configuration [4.9,037/121] tracing: Set kernel_stacks caller size properly [4.9,038/121] ar5523: Add USB ID of SMCWUSBT-G2 wireless adapter [4.9,039/121] Bluetooth: Fix refcount use-after-free issue [4.9,040/121] mm: pagewalk: fix termination condition in walk_pte_range() [4.9,041/121] Bluetooth: prefetch channel before killing sock [4.9,042/121] KVM: fix overflow of zero page refcount with ksm running [4.9,043/121] ALSA: hda: Clear RIRB status before reading WP [4.9,044/121] skbuff: fix a data race in skb_queue_len() [4.9,045/121] audit: CONFIG_CHANGE dont log internal bookkeeping as an event [4.9,046/121] selinux: sel_avc_get_stat_idx should increase position index [4.9,047/121] scsi: lpfc: Fix RQ buffer leakage when no IOCBs available [4.9,048/121] scsi: lpfc: Fix coverity errors in fmdi attribute handling [4.9,049/121] drm/omap: fix possible object reference leak [4.9,050/121] RDMA/rxe: Fix configuration of atomic queue pair attributes [4.9,051/121] KVM: x86: fix incorrect comparison in trace event [4.9,052/121] x86/pkeys: Add check for pkey "overflow" [4.9,053/121] bpf: Remove recursion prevention from rcu free callback [4.9,054/121] dmaengine: tegra-apb: Prevent race conditions on channels freeing [4.9,055/121] media: go7007: Fix URB type for interrupt handling [4.9,056/121] Bluetooth: guard against controllers sending zerod events [4.9,057/121] timekeeping: Prevent 32bit truncation in scale64_check_overflow() [4.9,058/121] drm/amdgpu: increase atombios cmd timeout [4.9,059/121] Bluetooth: L2CAP: handle l2cap config request during open state [4.9,060/121] media: tda10071: fix unsigned sign extension overflow [4.9,061/121] xfs: dont ever return a stale pointer from __xfs_dir3_free_read [4.9,062/121] tpm: ibmvtpm: Wait for buffer to be set before proceeding [4.9,063/121] tracing: Use address-of operator on section symbols [4.9,064/121] serial: 8250_port: Dont service RX FIFO if throttled [4.9,065/121] serial: 8250_omap: Fix sleeping function called from invalid context during probe [4.9,066/121] serial: 8250: 8250_omap: Terminate DMA before pushing data on RX timeout [4.9,067/121] cpufreq: powernv: Fix frame-size-overflow in powernv_cpufreq_work_fn [4.9,068/121] tools: gpio-hammer: Avoid potential overflow in main [4.9,069/121] SUNRPC: Fix a potential buffer overflow in svc_print_xprts() [4.9,070/121] svcrdma: Fix leak of transport addresses [4.9,071/121] ubifs: Fix out-of-bounds memory access caused by abnormal value of node_len [4.9,072/121] ALSA: usb-audio: Fix case when USB MIDI interface has more than one extra endpoint ... [4.9,073/121] mm/filemap.c: clear page error before actual read [4.9,074/121] mm/mmap.c: initialize align_offset explicitly for vm_unmapped_area [4.9,075/121] serial: uartps: Add a timeout to the tx empty wait [4.9,076/121] serial: uartps: Wait for tx_empty in console setup [4.9,077/121] KVM: Remove CREATE_IRQCHIP/SET_PIT2 race [4.9,078/121] bdev: Reduce time holding bd_mutex in sync in blkdev_close() [4.9,079/121] drivers: char: tlclk.c: Avoid data race between init and interrupt handler [4.9,080/121] dt-bindings: sound: wm8994: Correct required supplies based on actual implementaion [4.9,081/121] atm: fix a memory leak of vcc->user_back [4.9,082/121] phy: samsung: s5pv210-usb2: Add delay after reset [4.9,083/121] Bluetooth: Handle Inquiry Cancel error after Inquiry Complete [4.9,084/121] USB: EHCI: ehci-mv: fix error handling in mv_ehci_probe() [4.9,085/121] tty: serial: samsung: Correct clock selection logic [4.9,086/121] ALSA: hda: Fix potential race in unsol event handler [4.9,087/121] fuse: dont check refcount after stealing page [4.9,088/121] USB: EHCI: ehci-mv: fix less than zero comparison of an unsigned int [4.9,089/121] e1000: Do not perform reset in reset_task if we are already down [4.9,090/121] printk: handle blank console arguments passed in. [4.9,091/121] btrfs: dont force read-only after error in drop snapshot [4.9,092/121] vfio/pci: fix memory leaks of eventfd ctx [4.9,093/121] perf util: Fix memory leak of prefix_if_not_in [4.9,094/121] perf kcore_copy: Fix module map when there are no modules loaded [4.9,095/121] mtd: rawnand: omap_elm: Fix runtime PM imbalance on error [4.9,096/121] ceph: fix potential race in ceph_check_caps [4.9,097/121] mtd: parser: cmdline: Support MTD names containing one or more colons [4.9,098/121] x86/speculation/mds: Mark mds_user_clear_cpu_buffers() __always_inline [4.9,099/121] vfio/pci: Clear error and request eventfd ctx after releasing [4.9,100/121] cifs: Fix double add page to memcg when cifs_readpages [4.9,101/121] selftests/x86/syscall_nt: Clear weird flags after each test [4.9,102/121] vfio/pci: fix racy on error and request eventfd ctx [4.9,103/121] s390/init: add missing __init annotations [4.9,104/121] i2c: core: Call i2c_acpi_install_space_handler() before i2c_acpi_register_devices() [4.9,105/121] objtool: Fix noreturn detection for ignored functions [4.9,106/121] ieee802154/adf7242: check status of adf7242_read_reg [4.9,107/121] clocksource/drivers/h8300_timer8: Fix wrong return value in h8300_8timer_init() [4.9,108/121] mwifiex: Increase AES key storage size to 256 bits [4.9,109/121] batman-adv: bla: fix type misuse for backbone_gw hash indexing [4.9,110/121] atm: eni: fix the missed pci_disable_device() for eni_init_one() [4.9,111/121] batman-adv: mcast/TT: fix wrongly dropped or rerouted packets [4.9,112/121] mac802154: tx: fix use-after-free [4.9,113/121] batman-adv: Add missing include for in_interrupt() [4.9,114/121] batman-adv: mcast: fix duplicate mcast packets in BLA backbone from mesh [4.9,115/121] ALSA: asihpi: fix iounmap in error handler [4.9,116/121] MIPS: Add the missing CPU_1074K into __get_cpu_type() [4.9,117/121] kprobes: Fix to check probe enabled before disarm_kprobe_ftrace() [4.9,118/121] lib/string.c: implement stpcpy [4.9,119/121] ata: define AC_ERR_OK [4.9,120/121] ata: make qc_prep return ata_completion_errors [4.9,121/121] ata: sata_mv, avoid trigerrable BUG_ON

Commit Message

Greg Kroah-Hartman Sept. 29, 2020, 10:59 a.m. UTC

From: Eric Dumazet <edumazet@google.com>

[ Upstream commit 4a009cb04aeca0de60b73f37b102573354214b52 ]

skb_put_padto() and __skb_put_padto() callers
must check return values or risk use-after-free.

Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/linux/skbuff.h |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff mbox series

Patch

--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -2795,7 +2795,7 @@  static inline int skb_padto(struct sk_bu
  *	is untouched. Otherwise it is extended. Returns zero on
  *	success. The skb is freed on error.
  */
-static inline int skb_put_padto(struct sk_buff *skb, unsigned int len)
+static inline int __must_check skb_put_padto(struct sk_buff *skb, unsigned int len)
 {
 	unsigned int size = skb->len;