kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-26 19:14:18 +00:00
Code Issues Releases Packages Activity
linux/net
History
Andrew Jeffery 8ee6ec20dd net: mctp: Ensure keys maintain only one ref to corresponding dev 
[ Upstream commit e4f349bd6e ]

mctp_flow_prepare_output() is called in mctp_route_output(), which
places outbound packets onto a given interface. The packet may represent
a message fragment, in which case we provoke an unbalanced reference
count to the underlying device. This causes trouble if we ever attempt
to remove the interface:

    [   48.702195] usb 1-1: USB disconnect, device number 2
    [   58.883056] unregister_netdevice: waiting for mctpusb0 to become free. Usage count = 2
    [   69.022548] unregister_netdevice: waiting for mctpusb0 to become free. Usage count = 2
    [   79.172568] unregister_netdevice: waiting for mctpusb0 to become free. Usage count = 2
    ...

Predicate the invocation of mctp_dev_set_key() in
mctp_flow_prepare_output() on not already having associated the device
with the key. It's not yet realistic to uphold the property that the key
maintains only one device reference earlier in the transmission sequence
as the route (and therefore the device) may not be known at the time the
key is associated with the socket.

Fixes: 67737c4572 ("mctp: Pass flow data & flow release events to drivers")
Acked-by: Jeremy Kerr <jk@codeconstruct.com.au>
Signed-off-by: Andrew Jeffery <andrew@codeconstruct.com.au>
Link: https://patch.msgid.link/20250508-mctp-dev-refcount-v1-1-d4f965c67bb5@codeconstruct.com.au
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
History 2025-05-22 14:29:40 +02:00
..
6lowpan ipv6: eliminate ndisc_ops_is_useropt() 2024-08-12 17:23:57 -07:00
9p 9p/trans_fd: mark concurrent read and writes to p9_conn->err 2025-05-02 07:59:20 +02:00
802 net: 802: LLC+SNAP OID:PID lookup on start of skb data 2025-01-17 13:40:37 +01:00
8021q net: vlan: don't propagate flags on open 2025-04-20 10:15:21 +02:00
appletalk Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2024-05-09 10:01:01 -07:00
atm atm: Fix NULL pointer dereference 2025-04-07 10:08:35 +02:00
ax25 ax25: Fix refcount leak caused by setting SO_BINDTODEVICE sockopt 2025-02-21 14:01:16 +01:00
batman-adv batman-adv: Ignore own maximum aggregation size during RX 2025-03-28 22:03:31 +01:00
bluetooth Bluetooth: MGMT: Fix MGMT_OP_ADD_DEVICE invalid device flags 2025-05-22 14:29:39 +02:00
bpf bpf, test_run: Fix use-after-free issue in eth_skb_pkt_type() 2025-02-27 04:30:18 -08:00
bridge net: bridge: switchdev: do not notify new brentries as changed 2025-04-25 10:47:45 +02:00
caif move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
can can: gw: fix RCU/BH usage in cgw_create_job() 2025-05-18 08:24:48 +02:00
ceph ceph: allocate sparse_ext map only for sparse reads 2025-01-02 10:34:09 +01:00
core net: export a helper for adding up queue stats 2025-05-18 08:24:50 +02:00
dcb net: dcb: choose correct policy to parse DCB_ATTR_BCN 2023-08-01 21:07:46 -07:00
dccp dccp: Fix memory leak in dccp_feat_change_recv 2024-12-14 20:03:05 +01:00
devlink devlink: fix xa_alloc_cyclic() error handling 2025-03-28 22:03:27 +01:00
dns_resolver Networking changes for 6.8. 2024-01-11 10:07:29 -08:00
dsa net: dsa: avoid refcount warnings when ds->ops->tag_8021q_vlan_del() fails 2025-04-25 10:47:46 +02:00
ethernet netkit: Fix pkt_type override upon netkit pass verdict 2024-05-25 10:48:57 -07:00
ethtool ethtool: cmis_cdb: use correct rpl size in ethtool_cmis_module_poll() 2025-04-25 10:47:43 +02:00
handshake net/handshake: use sockfd_put() helper 2024-08-27 16:09:25 -07:00
hsr net: hsr: fix fill_frame_info() regression vs VLAN packets 2025-02-08 09:58:08 +01:00
ieee802154 net: ieee802154: do not leave a dangling sk pointer in ieee802154_create() 2024-12-14 20:03:47 +01:00
ife net: sched: ife: fix potential use-after-free 2023-12-15 10:50:18 +00:00
ipv4 net: use sock_gen_put() when sk_state is TCP_TIME_WAIT 2025-05-09 09:50:46 +02:00
ipv6 gre: Fix again IPv6 link-local address generation. 2025-05-18 08:24:48 +02:00
iucv s390/iucv: MSG_PEEK causes memory leak in iucv_sock_destruct() 2024-12-05 14:02:31 +01:00
kcm kcm: Serialise kcm_sendmsg() for the same socket. 2024-08-19 18:36:12 -07:00
key xfrm: Add support for per cpu xfrm state handling. 2025-02-08 09:58:00 +01:00
l2tp net/l2tp: fix warning in l2tp_exit_net found by syzbot 2024-12-05 14:02:31 +01:00
l3mdev l3mdev: l3mdev_master_upper_ifindex_by_index_rcu should be using netdev_master_upper_dev_get_rcu 2022-04-15 14:27:24 -07:00
lapb net: lapb: Use list_for_each_entry() to simplify code in lapb_iface.c 2021-06-08 16:31:25 -07:00
llc llc: do not use skb_get() before dev_queue_xmit() 2025-03-13 13:02:05 +01:00
mac80211 wifi: mac80211: fix the type of status_code for negotiated TID to Link Mapping 2025-05-18 08:24:48 +02:00
mac802154 mac802154: check local interfaces before deleting sdata list 2025-01-23 17:22:54 +01:00
mctp net: mctp: Ensure keys maintain only one ref to corresponding dev 2025-05-22 14:29:40 +02:00
mpls mpls: Handle error of rtnl_register_module(). 2024-10-10 15:39:35 +02:00
mptcp mptcp: only inc MPJoinAckHMacFailure for HMAC failures 2025-04-20 10:15:45 +02:00
ncsi net/ncsi: wait for the last response to Deselect Package before configuring channel 2025-02-17 10:05:41 +01:00
netfilter netfilter: ipset: fix region locking in hash types 2025-05-18 08:24:48 +02:00
netlabel netlabel: fix RCU annotation for IPv4 options on socket creation 2024-05-13 14:58:12 -07:00
netlink netlink: fix false positive warning in extack during dumps 2024-12-05 14:02:31 +01:00
netrom netrom: check buffer length before accessing it 2025-01-09 13:33:38 +01:00
nfc NFC: nci: Add bounds checking in nci_hci_create_pipe() 2025-02-17 10:05:40 +01:00
nsh nsh: Restore skb->{protocol,data,mac_header} for outer header in nsh_gso_segment(). 2024-04-26 12:20:01 +02:00
openvswitch openvswitch: Fix unsafe attribute parsing in output_userspace() 2025-05-18 08:24:47 +02:00
packet af_packet: fix vlan_get_protocol_dgram() vs MSG_PEEK 2025-01-09 13:33:42 +01:00
phonet phonet: Handle error of rtnl_register_module(). 2024-10-10 15:39:36 +02:00
psample psample: adjust size if rate_as_probability is set 2024-12-27 14:02:06 +01:00
qrtr net: qrtr: Update packets cloning when broadcasting 2024-09-24 10:48:16 +02:00
rds rds: sysctl: rds_tcp_{rcv,snd}buf: avoid using current->nsproxy 2025-01-17 13:40:47 +01:00
rfkill net: rfkill: gpio: Add check for clk_enable() 2024-12-05 14:01:57 +01:00
rose net: rose: lock the socket in rose_bind() 2025-02-17 10:05:01 +01:00
rxrpc rxrpc: rxperf: Fix missing decoding of terminal magic cookie 2025-03-07 18:25:29 +01:00
sched net_sched: Flush gso_skb list too during ->change() 2025-05-22 14:29:39 +02:00
sctp sctp: detect and prevent references to a freed transport in sendmsg 2025-04-20 10:15:50 +02:00
smc smc: Fix lockdep false-positive for IPPROTO_SMC. 2025-04-25 10:47:42 +02:00
strparser strparser: Add read_sock callback 2025-02-27 04:30:19 -08:00
sunrpc svcrdma: do not unregister device for listeners 2025-04-20 10:15:43 +02:00
switchdev net: switchdev: Convert blocking notification chain to a raw one 2025-03-22 12:54:12 -07:00
tipc tipc: fix NULL pointer dereference in tipc_mon_reinit_self() 2025-05-02 07:59:02 +02:00
tls net: tls: explicitly disallow disconnect 2025-04-20 10:15:06 +02:00
unix splice: do not checksum AF_UNIX sockets 2024-12-19 18:12:59 +01:00
vmw_vsock vsock: avoid timeout during connect() if the socket is closing 2025-04-10 14:39:34 +02:00
wireless wifi: cfg80211: fix out-of-bounds access during multi-link element defragmentation 2025-05-18 08:24:47 +02:00
x25 net: change proto and proto_ops accept type 2024-05-13 18:19:09 -06:00
xdp xsk: Fix race condition in AF_XDP generic RX path 2025-05-09 09:50:38 +02:00
xfrm xfrm_output: Force software GSO only in tunnel mode 2025-03-28 22:03:25 +01:00
compat.c file: stop exposing receive_fd_user() 2023-12-12 14:24:14 +01:00
devres.c net: devres: Correct a grammatical error 2021-06-11 12:55:28 -07:00
Kconfig memory-provider: disable building dmabuf mp on !CONFIG_PAGE_POOL 2024-09-13 11:41:45 -07:00
Kconfig.debug net: make NET_(DEV|NS)_REFCNT_TRACKER depend on NET 2022-09-20 14:23:56 -07:00
Makefile af_unix: Remove CONFIG_UNIX_SCM. 2024-01-31 16:41:16 -08:00
socket.c net: explicitly clear the sk pointer, when pf->create fails 2024-10-07 16:21:59 -07:00
sysctl_net.c sysctl: Remove check for sentinel element in ctl_table arrays 2024-06-13 10:50:52 +02:00