kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-18 19:12:56 +00:00
Code Issues Releases Packages Activity
linux/net
History
Kuniyuki Iwashima 2b1bef126b tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). 
commit c65f27b9c3 upstream.

get_netdev_for_sock() is called during setsockopt(),
so not under RCU.

Using sk_dst_get(sk)->dev could trigger UAF.

Let's use __sk_dst_get() and dst_dev_rcu().

Note that the only ->ndo_sk_get_lower_dev() user is
bond_sk_get_lower_dev(), which uses RCU.

Fixes: e8f6979981 ("net/tls: Add generic NIC offload infrastructure")
Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Sabrina Dubroca <sd@queasysnail.net>
Link: https://patch.msgid.link/20250916214758.650211-6-kuniyu@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
[ Keerthana: Backport to v5.15-v6.1 ]
Signed-off-by: Keerthana K <keerthana.kalyanasundaram@broadcom.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2026-02-06 16:42:01 +01:00
..
6lowpan 6lowpan: iphc: Fix an off-by-one check of array index 2021-07-22 16:19:03 +02:00
9p net/9p: fix double req put in p9_fd_cancelled 2025-10-19 16:21:28 +02:00
802 net: 802: LLC+SNAP OID:PID lookup on start of skb data 2025-01-23 17:15:49 +01:00
8021q net: vlan: sync VLAN features with lower device 2025-12-07 06:09:26 +09:00
appletalk net: appletalk: Fix use-after-free in AARP proxy probe 2025-08-28 16:24:04 +02:00
atm net: atm: fix memory leak in atm_register_sysfs when device_register fail 2025-09-09 18:50:20 +02:00
ax25 ax25: properly unshare skbs in ax25_kiss_rcv() 2025-09-09 18:50:20 +02:00
batman-adv batman-adv: fix OOB read/write in network-coding decode 2025-09-09 18:50:21 +02:00
bluetooth Bluetooth: Add more enc key size check 2025-12-07 06:09:36 +09:00
bpf bpf: Do not let BPF test infra emit invalid GSO types to stack 2026-02-06 16:41:58 +01:00
bpfilter bpfilter: Specify the log level for the kmsg message 2021-06-25 13:13:50 +02:00
bridge net: bridge: fix static key check 2026-02-06 16:42:00 +01:00
caif caif: fix integer underflow in cffrml_receive() 2026-01-19 13:09:44 +01:00
can net: can: j1939: j1939_xtp_rx_rts_session_active(): deactivate session upon receiving the second rts 2026-02-06 16:41:47 +01:00
ceph libceph: make calc_target() set t->paused, not just clear it 2026-01-19 13:10:14 +01:00
core bpf: Reject narrower access to pointer ctx fields 2026-02-06 16:41:59 +01:00
dcb net: dcb: choose correct policy to parse DCB_ATTR_BCN 2023-08-11 15:13:53 +02:00
dccp net: fix data-races around sk->sk_forward_alloc 2025-01-23 17:16:04 +01:00
dns_resolver keys, dns: Fix size check of V1 server-list header 2024-01-25 14:52:46 -08:00
dsa net: dsa: tag_brcm: legacy: fix untagged rx on unbridged ports for bcm63xx 2025-12-07 06:09:25 +09:00
ethernet gro: remove rcu_read_lock/rcu_read_unlock from gro_complete handlers 2024-09-12 11:07:47 +02:00
ethtool net: ethtool: fix the error condition in ethtool_get_phy_stats_ethtool() 2026-01-19 13:10:13 +01:00
hsr net/hsr: fix NULL pointer dereference in prp_get_untagged_frame() 2026-01-19 13:09:46 +01:00
ieee802154 net: ieee802154: do not leave a dangling sk pointer in ieee802154_create() 2024-12-14 19:51:37 +01:00
ife net: sched: ife: fix potential use-after-free 2024-01-05 15:13:29 +01:00
ipv4 net: Add locking to protect skb->dev access in ip_output 2026-02-06 16:42:01 +01:00
ipv6 ipv6: use the right ifindex when replying to icmpv6 from localhost 2026-02-06 16:41:59 +01:00
iucv s390/iucv: fix receive buffer virtual vs physical address confusion 2024-09-04 13:23:27 +02:00
kcm kcm: Serialise kcm_sendmsg() for the same socket. 2024-09-04 13:23:32 +02:00
key Revert "xfrm: destroy xfrm_state synchronously on net exit path" 2026-01-19 13:09:18 +01:00
l2tp l2tp: avoid one data-race in l2tp_tunnel_del_work() 2026-02-06 16:41:53 +01:00
l3mdev net: Add l3mdev index to flow struct and avoid oif reset for port devices 2024-10-17 15:11:57 +02:00
lapb net: lapb: Use list_for_each_entry() to simplify code in lapb_iface.c 2021-06-08 16:31:25 -07:00
llc llc: fix data loss when reading from a socket in llc_ui_recvmsg() 2025-06-04 14:38:06 +02:00
mac80211 wifi: mac80211: Discard Beacon frames to non-broadcast address 2026-01-19 13:10:11 +01:00
mac802154 mac802154: check local interfaces before deleting sdata list 2025-01-23 17:16:00 +01:00
mctp net: mctp: Prevent duplicate binds 2025-08-28 16:24:20 +02:00
mpls mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu(). 2025-06-27 11:05:36 +01:00
mptcp mptcp: only reset subflow errors when propagated 2026-02-06 16:42:01 +01:00
ncsi net: ncsi: Fix buffer overflow in fetching version id 2025-08-28 16:24:22 +02:00
netfilter netfilter: nf_conncount: update last_gc only when GC has been performed 2026-01-19 13:10:16 +01:00
netlabel calipso: unlock rcu before returning -EAFNOSUPPORT 2025-06-27 11:05:22 +01:00
netlink netlink: avoid infinite retry looping in netlink_unicast() 2025-08-28 16:24:15 +02:00
netrom netrom: fix double-free in nr_route_frame() 2026-02-06 16:41:58 +01:00
nfc nfc: nci: Fix race between rfkill and nci_unregister_device(). 2026-02-06 16:42:00 +01:00
nsh nsh: Restore skb->{protocol,data,mac_header} for outer header in nsh_gso_segment(). 2024-05-17 11:50:48 +02:00
openvswitch net: openvswitch: Avoid needlessly taking the RTNL on vport destroy 2026-01-19 13:09:56 +01:00
packet net/packet: fix a race in packet_set_ring() and packet_notifier() 2025-08-28 16:24:14 +02:00
phonet phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept() 2025-08-28 16:23:59 +02:00
psample psample: Require 'CAP_NET_ADMIN' when joining "packets" group 2023-12-13 18:36:37 +01:00
qrtr net: qrtr: Update packets cloning when broadcasting 2024-10-17 15:11:08 +02:00
rds rds: Fix endianness annotation for RDS_MPATH_HASH 2025-12-07 06:09:19 +09:00
rfkill net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer 2025-10-02 13:39:09 +02:00
rose net: rose: fix invalid array index in rose_kill_by_device() 2026-01-19 13:09:58 +01:00
rxrpc rxrpc: Fix oops due to non-existence of prealloc backlog struct 2025-07-17 18:30:48 +02:00
sched net/sched: act_ife: avoid possible NULL deref 2026-02-06 16:41:55 +01:00
sctp sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT 2026-02-06 16:41:52 +01:00
smc net/smc: fix mismatch between CLC header and proposal 2025-12-07 06:09:27 +09:00
strparser strparser: Fix signed/unsigned mismatch bug 2025-12-07 06:09:29 +09:00
sunrpc SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf 2026-01-19 13:10:08 +01:00
switchdev net: make switchdev_bridge_port_{,unoffload} loosely coupled with the bridge 2021-08-04 12:35:07 +01:00
tipc tipc: Fix use-after-free in tipc_mon_reinit_self(). 2025-12-07 06:09:27 +09:00
tls tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). 2026-02-06 16:42:01 +01:00
unix af_unix: Don't leave consecutive consumed OOB skbs. 2025-10-02 13:39:14 +02:00
vmw_vsock vsock: Ignore signal/timeout on connect() if already established 2025-12-07 06:09:31 +09:00
wireless wifi: avoid kernel-infoleak from struct iw_point 2026-01-19 13:10:14 +01:00
x25 net/x25: fix incorrect parameter validation in the x25_getsockopt() function 2024-03-26 18:21:23 -04:00
xdp xsk: fix OOB map writes when deleting elements 2024-12-14 19:51:33 +01:00
xfrm xfrm: flush all states in xfrm_state_fini 2026-01-19 13:09:19 +01:00
compat.c net: Return the correct errno code 2021-06-03 15:13:56 -07:00
devres.c net: devres: Correct a grammatical error 2021-06-11 12:55:28 -07:00
Kconfig Remove DECnet support from kernel 2023-06-21 15:59:15 +02:00
Makefile Remove DECnet support from kernel 2023-06-21 15:59:15 +02:00
socket.c net: Remove RTNL dance for SIOCBRADDIF and SIOCBRDELIF. 2026-01-19 13:10:11 +01:00
sysctl_net.c net: Ensure net namespace isolation of sysctls 2021-04-12 13:27:11 -07:00