Merge branch 'net-fix-uaf-of-sk_dst_get-sk-dev'

Browse source

Kuniyuki Iwashima says:

====================
net: Fix UAF of sk_dst_get(sk)->dev.

syzbot caught use-after-free of sk_dst_get(sk)->dev,
which was not fetched under RCU nor RTNL. [0]

Patch 1 ~ 5, 7 fix UAF in smc, tcp, ktls, mptcp
Patch 6 fixes dst ref leak in mptcp

[0]: https://lore.kernel.org/68c237c7.050a0220.3c6139.0036.GAE@google.com

v1: https://lore.kernel.org/20250911030620.1284754-1-kuniyu@google.com
====================

Link: https://patch.msgid.link/20250916214758.650211-1-kuniyu@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

...

This commit is contained in:

Jakub Kicinski 2025-09-17 18:10:24 -07:00

parent 6b957c0a36 893c49a78d

commit e218ae4024

5 changed files with 86 additions and 78 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

9

net/mptcp/ctrl.c

View file

67

net/smc/smc_clc.c

View file

27

net/smc/smc_core.c

View file

43

net/smc/smc_pnet.c

View file

18

net/tls/tls_device.c

View file