Reference in a new issue

Blame

Copy permalink

Reference in a new issue

Copy permalink

Jun Yang 59f61c39cb sctp: fix stream->outcnt underflow on duplicate RECONF responses ... commit 3faf13aff2 upstream. A cached RECONF chunk may contain more than one request parameter. A duplicate response can therefore find and process the same ADD_OUT request again while another parameter is still outstanding, rolling back outcnt twice and possibly underflowing it. Track outstanding request types as bits and clear each bit after its first response. Later responses for the same request are then ignored. Fixes: 11ae76e67a ("sctp: implement receiver-side procedures for the Reconf Response Parameter") Cc: stable@kernel.org Reported-by: TencentOS Corvus AI <corvus@tencent.com> Link: https://lore.kernel.org/netdev/20260730110225.37371-1-juny24602@gmail.com/ Suggested-by: Xin Long <lucien.xin@gmail.com> Assisted-by: tencentos-corvus-ai:kimi-k3 Signed-off-by: Jun Yang <junvyyang@tencent.com> Link: https://patch.msgid.link/20260824081832.98717-3-juny24602@gmail.com Signed-off-by: Paolo Abeni <pabeni@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		History 2026-09-14 13:20:11 +02:00
..
6lowpan	6lowpan: fix NHC entry use-after-free on error path	2026-07-24 15:51:20 +02:00
9p	net/9p: fix infinite loop in p9_client_rpc on fatal signal	2026-07-24 15:51:50 +02:00
802	net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr	2026-06-19 13:33:34 +02:00
8021q	net: vlan: sync VLAN features with lower device	2025-12-07 06:09:26 +09:00
appletalk	net: appletalk: Fix use-after-free in AARP proxy probe	2025-08-28 16:24:04 +02:00
atm	net: atm: reject out-of-range traffic classes in QoS validation	2026-07-24 15:51:46 +02:00
ax25	ax25: properly unshare skbs in ax25_kiss_rcv()	2025-09-09 18:50:20 +02:00
batman-adv	batman-adv: clean untagged VLAN on netdev registration failure	2026-07-24 15:51:53 +02:00
bluetooth	Bluetooth: hci_event: clear HCI_LE_ADV only on a created connection	2026-09-14 13:20:08 +02:00
bpf	bpf: reject short IPv4/IPv6 inputs in bpf_prog_test_run_skb	2026-06-01 17:35:29 +02:00
bpfilter	bpfilter: Specify the log level for the kmsg message	2021-06-25 13:13:50 +02:00
bridge	net: bridge: mcast: fix use-after-free of a master VLAN's multicast context	2026-09-02 14:27:28 +02:00
caif	net: caif: clear client service pointer on teardown	2026-06-01 17:35:14 +02:00
can	can: j1939: make j1939_sk_bind() fail if device is no longer registered	2026-09-02 14:27:26 +02:00
ceph	libceph: reject buckets with mismatched CRUSH ids	2026-09-14 13:20:06 +02:00
core	bpf: Remove tst_run from lwt_seg6local_prog_ops.	2026-09-02 14:27:25 +02:00
dcb	net: dcb: choose correct policy to parse DCB_ATTR_BCN	2023-08-11 15:13:53 +02:00
dccp	net: fix data-races around sk->sk_forward_alloc	2025-01-23 17:16:04 +01:00
dns_resolver	keys, dns: Fix size check of V1 server-list header	2024-01-25 14:52:46 -08:00
dsa	net: dsa: tag_ksz: do not rely on skb_mac_header() in TX paths	2026-07-24 15:51:27 +02:00
ethernet	gro: remove rcu_read_lock/rcu_read_unlock from gro_complete handlers	2024-09-12 11:07:47 +02:00
ethtool	ethtool: eeprom: add more safeties to EEPROM Netlink fallback	2026-06-19 13:33:24 +02:00
hsr	net: hsr: fix memory leak on slave unregistration by removing synced VLANs	2026-08-19 17:13:58 +02:00
ieee802154	ieee802154: allow legacy LLSEC ADD/DEL ops to pass strict validation	2026-07-24 15:51:53 +02:00
ife	net: ife: require ETH_HLEN to be pullable in ife_decode()	2026-07-24 15:51:46 +02:00
ipv4	ipv4: igmp: Fix potential UAF in igmp_gq_start_timer()	2026-09-02 14:27:26 +02:00
ipv6	ipv6: use RCU iterator to dump route exceptions	2026-09-14 13:20:09 +02:00
iucv	net/iucv: fix use-after-free of a severed iucv_path	2026-08-19 17:14:04 +02:00
kcm	kcm: use WRITE_ONCE() when changing lower socket callbacks	2026-07-24 15:51:36 +02:00
key	net: af_key: initialize alg_key_len for IPComp states	2026-07-24 15:51:21 +02:00
l2tp	l2tp: Drop large packets with UDP encap	2026-06-01 17:35:03 +02:00
l3mdev	net: Add l3mdev index to flow struct and avoid oif reset for port devices	2024-10-17 15:11:57 +02:00
lapb	net: lapb: Use list_for_each_entry() to simplify code in lapb_iface.c	2021-06-08 16:31:25 -07:00
llc	llc: fix SAP refcount leak when creating incoming sockets	2026-07-24 15:51:55 +02:00
mac80211	wifi: mac80211: validate individual TWT params before driver setup	2026-08-19 17:14:07 +02:00
mac802154	mac802154: llsec: reject frames shorter than the authentication tag	2026-08-19 17:14:04 +02:00
mctp	net: mctp: fix don't require received header reserved bits to be zero	2026-06-19 13:33:41 +02:00
mpls	mpls: reload header after pskb_may_pull()	2026-09-14 13:20:09 +02:00
mptcp	mptcp: fix uninitialized local_id in syncookie MP_JOIN reconstruction	2026-09-14 13:20:09 +02:00
ncsi	net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length	2026-08-19 17:14:14 +02:00
netfilter	ipvs: reload ip header after head reallocation	2026-09-02 14:27:25 +02:00
netlabel	netlabel: validate unlabeled address and mask attribute lengths	2026-06-19 13:33:35 +02:00
netlink	rtnetlink: add RTNL_FLAG_DUMP_UNLOCKED flag	2026-07-24 15:51:42 +02:00
netrom	netrom: fix double-free in nr_route_frame()	2026-02-06 16:41:58 +01:00
nfc	nfc: nci: add data_len bound checks to activation parameter extractors	2026-09-02 14:27:27 +02:00
nsh	nsh: Restore skb->{protocol,data,mac_header} for outer header in nsh_gso_segment().	2024-05-17 11:50:48 +02:00
openvswitch	openvswitch: only skb_tx_error() a packet we are about to drop	2026-09-14 13:20:11 +02:00
packet	packet: synchronize pressure clearing with ring reconfiguration	2026-08-27 14:28:20 +02:00
phonet	phonet: pep: fix use-after-free in pep_get_sb()	2026-08-19 17:14:03 +02:00
psample	net: psample: fix info leak in PSAMPLE_ATTR_DATA	2026-07-24 15:51:39 +02:00
qrtr	net: qrtr: ns: Raise lookup limit to 128	2026-08-19 17:14:14 +02:00
rds	rds: tcp: hold the RCU lock across ipv6_chk_addr() in rds_tcp_laddr_check()	2026-08-19 17:14:06 +02:00
rfkill	net: rfkill: prevent unlimited numbers of rfkill events from being created	2026-04-18 10:33:38 +02:00
rose	net/rose: fix NULL pointer dereference in rose_transmit_link on reconnect	2026-04-18 10:33:20 +02:00
rxrpc	rxrpc: serialize kernel accept preallocation with socket teardown	2026-08-23 14:17:18 +02:00
sched	net/sched: reject overly deep qdisc hierarchies	2026-08-27 14:28:19 +02:00
sctp	sctp: fix stream->outcnt underflow on duplicate RECONF responses	2026-09-14 13:20:11 +02:00
smc	smc: Use __sk_dst_get() and dst_dev_rcu() in smc_vlan_by_tcpsk().	2026-09-02 14:27:26 +02:00
strparser	net: strparser: fix skb_head leak in strp_abort_strp()	2026-06-01 17:35:14 +02:00
sunrpc	svcrdma: Fix offset arithmetic in read_chunk_range	2026-09-14 13:20:09 +02:00
switchdev	net: make switchdev_bridge_port_{,unoffload} loosely coupled with the bridge	2021-08-04 12:35:07 +01:00
tipc	tipc: restrict socket queue dumps in enqueue tracepoints	2026-08-23 14:17:18 +02:00
tls	tls: don't abort the connection on signal-interrupted sends	2026-08-19 17:14:14 +02:00
unix	af_unix: Reject SIOCATMARK on non-stream sockets	2026-07-04 13:39:37 +02:00
vmw_vsock	vsock/virtio: avoid refilling the RX queue after teardown	2026-08-19 17:14:17 +02:00
wireless	wifi: cfg80211: bound element ID read when checking non-inheritance	2026-08-19 17:13:53 +02:00
x25	net/x25: fix use-after-free of the socket by its timers	2026-08-23 14:17:31 +02:00
xdp	xsk: tighten UMEM headroom validation to account for tailroom and min frame	2026-06-01 17:35:02 +02:00
xfrm	xfrm: fix xfrm_state_construct() auth-trunc leak	2026-09-02 14:27:28 +02:00
compat.c	use less confusing names for iov_iter direction initializers	2026-06-19 13:33:46 +02:00
devres.c	net: devres: Correct a grammatical error	2021-06-11 12:55:28 -07:00
Kconfig	Remove DECnet support from kernel	2023-06-21 15:59:15 +02:00
Makefile	Remove DECnet support from kernel	2023-06-21 15:59:15 +02:00
socket.c	net: Drop the lock in skb_may_tx_timestamp()	2026-07-24 15:51:21 +02:00
sysctl_net.c	net: Ensure net namespace isolation of sysctls	2021-04-12 13:27:11 -07:00