kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-22 19:14:51 +00:00
Code Issues Releases Packages Activity
linux/net
History
Antoine Tenart 2eeab8c47c gro: fix ownership transfer 
commit ed4cccef64 upstream.

If packets are GROed with fraglist they might be segmented later on and
continue their journey in the stack. In skb_segment_list those skbs can
be reused as-is. This is an issue as their destructor was removed in
skb_gro_receive_list but not the reference to their socket, and then
they can't be orphaned. Fix this by also removing the reference to the
socket.

For example this could be observed,

  kernel BUG at include/linux/skbuff.h:3131!  (skb_orphan)
  RIP: 0010:ip6_rcv_core+0x11bc/0x19a0
  Call Trace:
   ipv6_list_rcv+0x250/0x3f0
   __netif_receive_skb_list_core+0x49d/0x8f0
   netif_receive_skb_list_internal+0x634/0xd40
   napi_complete_done+0x1d2/0x7d0
   gro_cell_poll+0x118/0x1f0

A similar construction is found in skb_gro_receive, apply the same
change there.

Fixes: 5e10da5385 ("skbuff: allow 'slow_gro' for skb carring sock reference")
Signed-off-by: Antoine Tenart <atenart@kernel.org>
Reviewed-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2024-04-10 16:28:26 +02:00
..
6lowpan net: 6lowpan: constify lowpan_nhc structures 2022-06-09 21:53:28 +02:00
9p net: 9p: avoid freeing uninit memory in p9pdu_vreadf 2024-01-01 12:39:04 +00:00
802 mrp: introduce active flags to prevent UAF when applicant uninit 2022-12-31 13:33:02 +01:00
8021q vlan: skip nested type that is not IFLA_VLAN_QOS_MAPPING 2024-01-31 16:17:04 -08:00
appletalk appletalk: Fix Use-After-Free in atalk_ioctl 2023-12-20 17:00:19 +01:00
atm atm: Fix Use-After-Free in do_vcc_ioctl 2023-12-20 17:00:17 +01:00
ax25 ax25: move from strlcpy with unused retval to strscpy 2022-08-22 17:55:50 -07:00
batman-adv net: vlan: introduce skb_vlan_eth_hdr() 2023-12-20 17:00:16 +01:00
bluetooth Bluetooth: Fix TOCTOU in HCI debugfs implementation 2024-04-10 16:28:24 +02:00
bpf Revert "bpf, test_run: fix &xdp_frame misplacement for LIVE_FRAMES" 2023-03-17 08:50:32 +01:00
bpfilter uaccess: remove CONFIG_SET_FS 2022-02-25 09:36:06 +01:00
bridge netfilter: validate user input for expected length 2024-04-10 16:28:25 +02:00
caif net: caif: Fix use-after-free in cfusbl_device_notify() 2023-03-17 08:50:24 +01:00
can can: j1939: Fix UAF in j1939_sk_match_filter during setsockopt(SO_J1939_FILTER) 2024-02-23 09:12:47 +01:00
ceph libceph: use kernel_connect() 2023-10-19 23:08:56 +02:00
core gro: fix ownership transfer 2024-04-10 16:28:26 +02:00
dcb net: dcb: choose correct policy to parse DCB_ATTR_BCN 2023-08-11 12:08:17 +02:00
dccp dccp/tcp: Call security_inet_conn_request() after setting IPv6 addresses. 2023-11-20 11:52:16 +01:00
devlink devlink: remove reload failed checks in params get/set callbacks 2023-09-23 11:11:01 +02:00
dns_resolver keys, dns: Fix size check of V1 server-list header 2024-01-25 15:27:38 -08:00
dsa net: dsa: sja1105: always enable the send_meta options 2023-07-19 16:22:06 +02:00
ethernet net: gro: skb_gro_header helper function 2022-08-25 10:33:21 +02:00
ethtool ethtool: netlink: Add missing ethnl_ops_begin/complete 2024-01-25 15:27:51 -08:00
hsr hsr: Handle failures in module init 2024-03-26 18:21:00 -04:00
ieee802154 net: ieee802154: fix error return code in dgram_bind() 2022-10-07 09:29:17 +02:00
ife net: sched: ife: fix potential use-after-free 2024-01-01 12:38:56 +00:00
ipv4 gro: fix ownership transfer 2024-04-10 16:28:26 +02:00
ipv6 netfilter: validate user input for expected length 2024-04-10 16:28:25 +02:00
iucv net/iucv: fix the allocation size of iucv_path_table array 2024-03-26 18:20:25 -04:00
kcm net: kcm: fix incorrect parameter validation in the kcm_getsockopt) function 2024-03-26 18:20:42 -04:00
key net: af_key: fix sadb_x_filter validation 2023-08-23 17:52:32 +02:00
l2tp l2tp: fix incorrect parameter validation in the pppol2tp_getsockopt() function 2024-03-26 18:20:42 -04:00
l3mdev l3mdev: l3mdev_master_upper_ifindex_by_index_rcu should be using netdev_master_upper_dev_get_rcu 2022-04-15 14:27:24 -07:00
lapb net: lapb: Use list_for_each_entry() to simplify code in lapb_iface.c 2021-06-08 16:31:25 -07:00
llc llc: call sock_orphan() at release time 2024-02-05 20:13:01 +00:00
mac80211 wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes 2024-04-03 15:19:48 +02:00
mac802154 mac802154: fix llsec key resources release in mac802154_llsec_key_del 2024-04-03 15:19:31 +02:00
mctp net: mctp: copy skb ext data when fragmenting 2024-03-26 18:20:37 -04:00
mpls net: mpls: fix stale pointer if allocation fails during device rename 2023-02-22 12:59:53 +01:00
mptcp mptcp: fix possible deadlock in subflow diag 2024-03-06 14:45:12 +00:00
ncsi net/ncsi: Fix netlink major/minor version numbers 2024-01-25 15:27:24 -08:00
netfilter netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get() 2024-04-10 16:28:25 +02:00
netlabel calipso: fix memory leak in netlbl_calipso_add_pass() 2024-01-25 15:27:20 -08:00
netlink netlink: Fix kernel-infoleak-after-free in __skb_datagram_iter 2024-03-06 14:45:06 +00:00
netrom netrom: Fix data-races around sysctl_net_busy_read 2024-03-15 10:48:18 -04:00
nfc nfc: nci: Fix uninit-value in nci_dev_up and nci_ntf_packet 2024-04-10 16:28:21 +02:00
nsh net: nsh: Use correct mac_offset to unwind gso skb in nsh_gso_segment() 2023-05-24 17:32:45 +01:00
openvswitch net: openvswitch: limit the number of recursions from action sets 2024-02-23 09:12:30 +01:00
packet packet: annotate data-races around ignore_outgoing 2024-03-26 18:20:59 -04:00
phonet phonet/pep: fix racy skb_queue_empty() use 2024-03-01 13:26:38 +01:00
psample psample: Require 'CAP_NET_ADMIN' when joining "packets" group 2023-12-13 18:39:11 +01:00
qrtr net: qrtr: ns: Return 0 if server port is not present 2024-01-20 11:50:09 +01:00
rds net/rds: fix possible cp null dereference 2024-04-10 16:28:25 +02:00
rfkill net: rfkill: gpio: set GPIO direction 2024-01-01 12:39:04 +00:00
rose net/rose: fix races in rose_kill_by_device() 2024-01-01 12:38:57 +00:00
rxrpc rxrpc: Fix response to PING RESPONSE ACKs to a dead call 2024-02-16 19:06:27 +01:00
sched net/sched: fix lockdep splat in qdisc_tree_reduce_backlog() 2024-04-10 16:28:26 +02:00
sctp sctp: fix busy polling 2024-01-25 15:27:30 -08:00
smc net/smc: disable SEID on non-s390 archs where virtual ISM may be used 2024-02-05 20:12:54 +00:00
strparser strparser: pad sk_skb_cb to avoid straddling cachelines 2022-07-08 18:38:44 -07:00
sunrpc net: sunrpc: Fix an off by one in rpc_sockaddr2uaddr() 2024-03-26 18:20:55 -04:00
switchdev net: bridge: switchdev: Skip MDB replays of deferred events on offload 2024-03-01 13:26:35 +01:00
tipc tipc: Check the bearer type before calling tipc_udp_nl_bearer_add() 2024-02-16 19:06:27 +01:00
tls tls: get psock ref after taking rxlock to avoid leak 2024-04-10 16:28:22 +02:00
unix af_unix: Annotate data-race of gc_in_progress in wait_for_unix_gc(). 2024-03-26 18:20:31 -04:00
vmw_vsock vsock/virtio: fix packet delivery to tap device 2024-04-10 16:28:25 +02:00
wireless wifi: nl80211: reject iftype change with mesh ID change 2024-03-06 14:45:10 +00:00
x25 net/x25: fix incorrect parameter validation in the x25_getsockopt() function 2024-03-26 18:20:42 -04:00
xdp xsk: Skip polling event check for unbound socket 2023-12-13 18:39:08 +01:00
xfrm xfrm: Avoid clang fortify warning in copy_to_user_tmpl() 2024-04-03 15:19:40 +02:00
compat.c use less confusing names for iov_iter direction initializers 2023-02-09 11:28:04 +01:00
devres.c net: devres: Correct a grammatical error 2021-06-11 12:55:28 -07:00
Kconfig Remove DECnet support from kernel 2022-08-22 14:26:30 +01:00
Kconfig.debug net: make NET_(DEV|NS)_REFCNT_TRACKER depend on NET 2022-09-20 14:23:56 -07:00
Makefile devlink: move code to a dedicated directory 2023-08-30 16:11:00 +02:00
socket.c splice, net: Add a splice_eof op to file-ops and socket-ops 2024-01-10 17:10:27 +01:00
sysctl_net.c sections: move and rename core_kernel_data() to is_kernel_core_data() 2021-11-09 10:02:50 -08:00