linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Sasha Levin <sashal@kernel.org>
To: stable@vger.kernel.org, linux-kernel@vger.kernel.org
Cc: David Herrmann <dh.herrmann@gmail.com>,
	"David S . Miller" <davem@davemloft.net>,
	Sasha Levin <sashal@kernel.org>
Subject: [PATCH AUTOSEL 4.4 03/65] net: drop write-only stack variable
Date: Thu, 25 Oct 2018 10:16:03 -0400	[thread overview]
Message-ID: <20181025141705.213937-3-sashal@kernel.org> (raw)
In-Reply-To: <20181025141705.213937-1-sashal@kernel.org>

From: David Herrmann <dh.herrmann@gmail.com>

[ Upstream commit 3575dbf2cbbc8e598f17ec441aed526dbea0e1bd ]

Remove a write-only stack variable from unix_attach_fds(). This is a
left-over from the security fix in:

    commit 712f4aad406bb1ed67f3f98d04c044191f0ff593
    Author: willy tarreau <w@1wt.eu>
    Date:   Sun Jan 10 07:54:56 2016 +0100

        unix: properly account for FDs passed over unix sockets

Signed-off-by: David Herrmann <dh.herrmann@gmail.com>
Acked-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/unix/af_unix.c | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index e05ec54ac53f..c6b1eec94911 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -1531,7 +1531,6 @@ static int unix_attach_fds(struct scm_cookie *scm, struct sk_buff *skb)
 {
 	int i;
 	unsigned char max_level = 0;
-	int unix_sock_count = 0;
 
 	if (too_many_unix_fds(current))
 		return -ETOOMANYREFS;
@@ -1539,11 +1538,9 @@ static int unix_attach_fds(struct scm_cookie *scm, struct sk_buff *skb)
 	for (i = scm->fp->count - 1; i >= 0; i--) {
 		struct sock *sk = unix_get_socket(scm->fp->fp[i]);
 
-		if (sk) {
-			unix_sock_count++;
+		if (sk)
 			max_level = max(max_level,
 					unix_sk(sk)->recursion_level);
-		}
 	}
 	if (unlikely(max_level > MAX_RECURSION_LEVEL))
 		return -ETOOMANYREFS;
-- 
2.17.1


  parent reply	other threads:[~2018-10-25 14:17 UTC|newest]

Thread overview: 70+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2018-10-25 14:16 [PATCH AUTOSEL 4.4 01/65] KEYS: put keyring if install_session_keyring_to_cred() fails Sasha Levin
2018-10-25 14:16 ` [PATCH AUTOSEL 4.4 02/65] ipv6: suppress sparse warnings in IP6_ECN_set_ce() Sasha Levin
2018-10-25 14:16 ` Sasha Levin [this message]
2018-10-25 14:16 ` [PATCH AUTOSEL 4.4 04/65] ser_gigaset: use container_of() instead of detour Sasha Levin
2018-10-25 14:16 ` [PATCH AUTOSEL 4.4 05/65] tracing: Skip more functions when doing stack tracing of events Sasha Levin
2018-10-25 14:16 ` [PATCH AUTOSEL 4.4 06/65] ARM: dts: apq8064: add ahci ports-implemented mask Sasha Levin
2018-10-25 14:16 ` [PATCH AUTOSEL 4.4 07/65] x86/mm/pat: Prevent hang during boot when mapping pages Sasha Levin
2018-10-25 14:16 ` [PATCH AUTOSEL 4.4 08/65] btrfs: cleaner_kthread() doesn't need explicit freeze Sasha Levin
2018-10-25 15:07   ` David Sterba
2018-10-25 20:07     ` Sasha Levin
2018-10-26  6:58       ` Jiri Kosina
2018-10-26 10:57         ` Sasha Levin
2018-10-25 14:16 ` [PATCH AUTOSEL 4.4 09/65] radix-tree: fix radix_tree_iter_retry() for tagged iterators Sasha Levin
2018-10-25 14:16 ` [PATCH AUTOSEL 4.4 10/65] af_iucv: Move sockaddr length checks to before accessing sa_family in bind and connect handlers Sasha Levin
2018-10-25 14:16 ` [PATCH AUTOSEL 4.4 11/65] net/mlx4_en: Resolve dividing by zero in 32-bit system Sasha Levin
2018-10-25 14:16 ` [PATCH AUTOSEL 4.4 12/65] ipv6: orphan skbs in reassembly unit Sasha Levin
2018-10-25 14:16 ` [PATCH AUTOSEL 4.4 13/65] um: Avoid longjmp/setjmp symbol clashes with libpthread.a Sasha Levin
2018-10-25 14:16 ` [PATCH AUTOSEL 4.4 14/65] sched/cgroup: Fix cgroup entity load tracking tear-down Sasha Levin
2018-10-25 14:16 ` [PATCH AUTOSEL 4.4 15/65] btrfs: don't create or leak aliased root while cleaning up orphans Sasha Levin
2018-10-25 15:12   ` David Sterba
2018-10-25 14:16 ` [PATCH AUTOSEL 4.4 16/65] thermal: allow spear-thermal driver to be a module Sasha Levin
2018-10-25 14:16 ` [PATCH AUTOSEL 4.4 17/65] thermal: allow u8500-thermal " Sasha Levin
2018-10-25 14:16 ` [PATCH AUTOSEL 4.4 18/65] tpm: fix: return rc when devm_add_action() fails Sasha Levin
2018-10-25 14:16 ` [PATCH AUTOSEL 4.4 19/65] x86/PCI: Mark Broadwell-EP Home Agent 1 as having non-compliant BARs Sasha Levin
2018-10-25 14:16 ` [PATCH AUTOSEL 4.4 20/65] aacraid: Start adapter after updating number of MSIX vectors Sasha Levin
2018-10-25 14:16 ` [PATCH AUTOSEL 4.4 21/65] perf/core: Don't leak event in the syscall error path Sasha Levin
2018-10-25 14:16 ` [PATCH AUTOSEL 4.4 22/65] [media] usbvision: revert commit 588afcc1 Sasha Levin
2018-10-25 14:16 ` [PATCH AUTOSEL 4.4 23/65] MIPS: Fix FCSR Cause bit handling for correct SIGFPE issue Sasha Levin
2018-10-25 14:16 ` [PATCH AUTOSEL 4.4 24/65] ASoC: ak4613: Enable cache usage to fix crashes on resume Sasha Levin
2018-10-25 14:16 ` [PATCH AUTOSEL 4.4 25/65] ASoC: wm8940: " Sasha Levin
2018-10-25 14:16 ` [PATCH AUTOSEL 4.4 26/65] CIFS: handle guest access errors to Windows shares Sasha Levin
2018-10-25 14:16 ` [PATCH AUTOSEL 4.4 27/65] arm64: Fix potential race with hardware DBM in ptep_set_access_flags() Sasha Levin
2018-10-25 14:16 ` [PATCH AUTOSEL 4.4 28/65] xfrm: Clear sk_dst_cache when applying per-socket policy Sasha Levin
2018-10-25 14:16 ` [PATCH AUTOSEL 4.4 29/65] scsi: Add STARGET_CREATED_REMOVE state to scsi_target_state Sasha Levin
2018-10-25 14:16 ` [PATCH AUTOSEL 4.4 30/65] sparc/pci: Refactor dev_archdata initialization into pci_init_dev_archdata Sasha Levin
2018-10-25 14:16 ` [PATCH AUTOSEL 4.4 31/65] sch_red: update backlog as well Sasha Levin
2018-10-25 14:16 ` [PATCH AUTOSEL 4.4 32/65] usb-storage: fix bogus hardware error messages for ATA pass-thru devices Sasha Levin
2018-10-25 14:16 ` [PATCH AUTOSEL 4.4 33/65] bpf: generally move prog destruction to RCU deferral Sasha Levin
2018-10-25 14:16 ` [PATCH AUTOSEL 4.4 34/65] drm/nouveau/fbcon: fix oops without fbdev emulation Sasha Levin
2018-10-25 14:16 ` [PATCH AUTOSEL 4.4 35/65] fuse: Dont call set_page_dirty_lock() for ITER_BVEC pages for async_dio Sasha Levin
2018-10-25 14:16 ` [PATCH AUTOSEL 4.4 36/65] ixgbevf: Fix handling of NAPI budget when multiple queues are enabled per vector Sasha Levin
2018-10-25 14:16 ` [PATCH AUTOSEL 4.4 37/65] net/mlx5e: Fix LRO modify Sasha Levin
2018-10-25 14:16 ` [PATCH AUTOSEL 4.4 38/65] net/mlx5e: Correctly handle RSS indirection table when changing number of channels Sasha Levin
2018-10-25 14:16 ` [PATCH AUTOSEL 4.4 39/65] ixgbe: fix RSS limit for X550 Sasha Levin
2018-10-25 14:16 ` [PATCH AUTOSEL 4.4 40/65] ixgbe: Correct X550EM_x revision check Sasha Levin
2018-10-25 14:16 ` [PATCH AUTOSEL 4.4 41/65] ALSA: timer: Fix zero-division by continue of uninitialized instance Sasha Levin
2018-10-25 14:16 ` [PATCH AUTOSEL 4.4 42/65] vti6: flush x-netns xfrm cache when vti interface is removed Sasha Levin
2018-10-25 14:16 ` [PATCH AUTOSEL 4.4 43/65] gro: Allow tunnel stacking in the case of FOU/GUE Sasha Levin
2018-10-25 14:16 ` [PATCH AUTOSEL 4.4 44/65] brcmfmac: Fix glom_skb leak in brcmf_sdiod_recv_chain Sasha Levin
2018-10-25 14:16 ` [PATCH AUTOSEL 4.4 45/65] l2tp: hold socket before dropping lock in l2tp_ip{, 6}_recv() Sasha Levin
2018-10-25 14:16 ` [PATCH AUTOSEL 4.4 46/65] tty: serial: sprd: fix error return code in sprd_probe() Sasha Levin
2018-10-25 14:16 ` [PATCH AUTOSEL 4.4 47/65] video: fbdev: pxa3xx_gcu: fix error return code in pxa3xx_gcu_probe() Sasha Levin
2018-10-25 14:16 ` [PATCH AUTOSEL 4.4 48/65] sparc64 mm: Fix more TSB sizing issues Sasha Levin
2018-10-25 14:16 ` [PATCH AUTOSEL 4.4 49/65] gpu: host1x: fix error return code in host1x_probe() Sasha Levin
2018-10-25 14:16 ` [PATCH AUTOSEL 4.4 50/65] sparc64: Fix exception handling in UltraSPARC-III memcpy Sasha Levin
2018-10-25 14:16 ` [PATCH AUTOSEL 4.4 51/65] gpio: msic: fix error return code in platform_msic_gpio_probe() Sasha Levin
2018-10-25 14:16 ` [PATCH AUTOSEL 4.4 52/65] usb: imx21-hcd: fix error return code in imx21_probe() Sasha Levin
2018-10-25 14:16 ` [PATCH AUTOSEL 4.4 53/65] usb: ehci-omap: fix error return code in ehci_hcd_omap_probe() Sasha Levin
2018-10-25 14:16 ` [PATCH AUTOSEL 4.4 54/65] usb: dwc3: omap: fix error return code in dwc3_omap_probe() Sasha Levin
2018-10-25 14:16 ` [PATCH AUTOSEL 4.4 55/65] spi/bcm63xx-hspi: fix error return code in bcm63xx_hsspi_probe() Sasha Levin
2018-10-25 14:16 ` [PATCH AUTOSEL 4.4 56/65] MIPS: Handle non word sized instructions when examining frame Sasha Levin
2018-10-25 14:16 ` [PATCH AUTOSEL 4.4 57/65] spi/bcm63xx: fix error return code in bcm63xx_spi_probe() Sasha Levin
2018-10-25 14:16 ` [PATCH AUTOSEL 4.4 58/65] spi: xlp: fix error return code in xlp_spi_probe() Sasha Levin
2018-10-25 14:16 ` [PATCH AUTOSEL 4.4 59/65] ASoC: spear: fix error return code in spdif_in_probe() Sasha Levin
2018-10-25 14:17 ` [PATCH AUTOSEL 4.4 60/65] PM / devfreq: tegra: fix error return code in tegra_devfreq_probe() Sasha Levin
2018-10-25 14:17 ` [PATCH AUTOSEL 4.4 61/65] bonding: avoid defaulting hard_header_len to ETH_HLEN on slave removal Sasha Levin
2018-10-25 14:17 ` [PATCH AUTOSEL 4.4 62/65] scsi: aacraid: Fix typo in blink status Sasha Levin
2018-10-25 14:17 ` [PATCH AUTOSEL 4.4 63/65] MIPS: microMIPS: Fix decoding of swsp16 instruction Sasha Levin
2018-10-25 14:17 ` [PATCH AUTOSEL 4.4 64/65] igb: Remove superfluous reset to PHY and page 0 selection Sasha Levin
2018-10-25 14:17 ` [PATCH AUTOSEL 4.4 65/65] MIPS: DEC: Fix an int-handler.S CPU_DADDI_WORKAROUNDS regression Sasha Levin

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20181025141705.213937-3-sashal@kernel.org \
    --to=sashal@kernel.org \
    --cc=davem@davemloft.net \
    --cc=dh.herrmann@gmail.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=stable@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).