Reference in a new issue

Blame

Copy permalink

Reference in a new issue

Copy permalink

Florian Westphal c0f1f85097 netfilter: nft_set_pipapo: split gc into unlink and reclaim phase ... commit 9df95785d3 upstream. Yiming Qian reports Use-after-free in the pipapo set type: Under a large number of expired elements, commit-time GC can run for a very long time in a non-preemptible context, triggering soft lockup warnings and RCU stall reports (local denial of service). We must split GC in an unlink and a reclaim phase. We cannot queue elements for freeing until pointers have been swapped. Expired elements are still exposed to both the packet path and userspace dumpers via the live copy of the data structure. call_rcu() does not protect us: dump operations or element lookups starting after call_rcu has fired can still observe the free'd element, unless the commit phase has made enough progress to swap the clone and live pointers before any new reader has picked up the old version. This a similar approach as done recently for the rbtree backend in commit 35f83a7552 ("netfilter: nft_set_rbtree: don't gc elements on insert"). Fixes: 3c4287f620 ("nf_tables: Add set type for arbitrary concatenation of ranges") Reported-by: Yiming Qian <yimingqian591@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		History 2026-04-18 10:33:22 +02:00
..
6lowpan	6lowpan: iphc: Fix an off-by-one check of array index	2021-07-22 16:19:03 +02:00
9p	net/9p: fix double req put in p9_fd_cancelled	2025-10-19 16:21:28 +02:00
802	net: 802: LLC+SNAP OID:PID lookup on start of skb data	2025-01-23 17:15:49 +01:00
8021q	net: vlan: sync VLAN features with lower device	2025-12-07 06:09:26 +09:00
appletalk	net: appletalk: Fix use-after-free in AARP proxy probe	2025-08-28 16:24:04 +02:00
atm	atm: lec: fix null-ptr-deref in lec_arp_clear_vccs	2026-04-18 10:33:10 +02:00
ax25	ax25: properly unshare skbs in ax25_kiss_rcv()	2025-09-09 18:50:20 +02:00
batman-adv	batman-adv: avoid OGM aggregation when skb tailroom is insufficient	2026-04-18 10:33:19 +02:00
bluetooth	Bluetooth: HIDP: Fix possible UAF	2026-04-18 10:33:20 +02:00
bpf	bpf: Do not let BPF test infra emit invalid GSO types to stack	2026-02-06 16:41:58 +01:00
bpfilter	bpfilter: Specify the log level for the kmsg message	2021-06-25 13:13:50 +02:00
bridge	net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled	2026-04-18 10:33:10 +02:00
caif	caif: fix integer underflow in cffrml_receive()	2026-01-19 13:09:44 +01:00
can	can: bcm: fix locking for bcm_op runtime updates	2026-04-18 10:33:10 +02:00
ceph	libceph: admit message frames only in CEPH_CON_S_OPEN state	2026-04-18 10:33:14 +02:00
core	net: Handle napi_schedule() calls from non-interrupt	2026-04-18 10:33:18 +02:00
dcb	net: dcb: choose correct policy to parse DCB_ATTR_BCN	2023-08-11 15:13:53 +02:00
dccp	net: fix data-races around sk->sk_forward_alloc	2025-01-23 17:16:04 +01:00
dns_resolver	keys, dns: Fix size check of V1 server-list header	2024-01-25 14:52:46 -08:00
dsa	net: dsa: free routing table on probe failure	2026-02-19 16:21:45 +01:00
ethernet	gro: remove rcu_read_lock/rcu_read_unlock from gro_complete handlers	2024-09-12 11:07:47 +02:00
ethtool	ethtool: add support to set/get tx copybreak buf size via ethtool	2026-03-04 07:19:36 -05:00
hsr	net/hsr: fix NULL pointer dereference in prp_get_untagged_frame()	2026-01-19 13:09:46 +01:00
ieee802154	net: ieee802154: do not leave a dangling sk pointer in ieee802154_create()	2024-12-14 19:51:37 +01:00
ife	net: sched: ife: fix potential use-after-free	2024-01-05 15:13:29 +01:00
ipv4	icmp: fix NULL pointer dereference in icmp_tag_validation()	2026-04-18 10:33:22 +02:00
ipv6	net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop	2026-04-18 10:33:10 +02:00
iucv	s390/iucv: fix receive buffer virtual vs physical address confusion	2024-09-04 13:23:27 +02:00
kcm	kcm: Serialise kcm_sendmsg() for the same socket.	2024-09-04 13:23:32 +02:00
key	Revert "xfrm: destroy xfrm_state synchronously on net exit path"	2026-01-19 13:09:18 +01:00
l2tp	l2tp: do not use sock_hold() in pppol2tp_session_get_sock()	2026-04-18 10:33:17 +02:00
l3mdev	net: Add l3mdev index to flow struct and avoid oif reset for port devices	2024-10-17 15:11:57 +02:00
lapb	net: lapb: Use list_for_each_entry() to simplify code in lapb_iface.c	2021-06-08 16:31:25 -07:00
llc	llc: fix data loss when reading from a socket in llc_ui_recvmsg()	2025-06-04 14:38:06 +02:00
mac80211	wifi: mac80211: fix NULL deref in mesh_matches_local()	2026-04-18 10:33:21 +02:00
mac802154	mac802154: check local interfaces before deleting sdata list	2025-01-23 17:16:00 +01:00
mctp	net: mctp: Prevent duplicate binds	2025-08-28 16:24:20 +02:00
mpls	mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu().	2025-06-27 11:05:36 +01:00
mptcp	mptcp: pm: avoid sending RM_ADDR over same subflow	2026-04-18 10:33:19 +02:00
ncsi	net: ncsi: fix skb leak in error paths	2026-04-18 10:33:15 +02:00
netfilter	netfilter: nft_set_pipapo: split gc into unlink and reclaim phase	2026-04-18 10:33:22 +02:00
netlabel	calipso: unlock rcu before returning -EAFNOSUPPORT	2025-06-27 11:05:22 +01:00
netlink	netlink: avoid infinite retry looping in netlink_unicast()	2025-08-28 16:24:15 +02:00
netrom	netrom: fix double-free in nr_route_frame()	2026-02-06 16:41:58 +01:00
nfc	nfc: rawsock: cancel tx_work before socket teardown	2026-04-18 10:33:10 +02:00
nsh	nsh: Restore skb->{protocol,data,mac_header} for outer header in nsh_gso_segment().	2024-05-17 11:50:48 +02:00
openvswitch	net: openvswitch: Avoid needlessly taking the RTNL on vport destroy	2026-01-19 13:09:56 +01:00
packet	net/packet: fix a race in packet_set_ring() and packet_notifier()	2025-08-28 16:24:14 +02:00
phonet	phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept()	2025-08-28 16:23:59 +02:00
psample	psample: Require 'CAP_NET_ADMIN' when joining "packets" group	2023-12-13 18:36:37 +01:00
qrtr	net: qrtr: Update packets cloning when broadcasting	2024-10-17 15:11:08 +02:00
rds	net/rds: Clear reconnect pending bit	2026-03-04 07:20:11 -05:00
rfkill	net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer	2025-10-02 13:39:09 +02:00
rose	net/rose: fix NULL pointer dereference in rose_transmit_link on reconnect	2026-04-18 10:33:20 +02:00
rxrpc	rxrpc: Fix oops due to non-existence of prealloc backlog struct	2025-07-17 18:30:48 +02:00
sched	net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit	2026-04-18 10:33:12 +02:00
sctp	sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT	2026-02-06 16:41:52 +01:00
smc	net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock()	2026-04-18 10:33:21 +02:00
strparser	strparser: Fix signed/unsigned mismatch bug	2025-12-07 06:09:29 +09:00
sunrpc	sunrpc: fix cache_request leak in cache_release	2026-04-18 10:33:17 +02:00
switchdev	net: make switchdev_bridge_port_{,unoffload} loosely coupled with the bridge	2021-08-04 12:35:07 +01:00
tipc	tipc: fix divide-by-zero in tipc_sk_filter_connect()	2026-04-18 10:33:14 +02:00
tls	tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock().	2026-02-06 16:42:01 +01:00
unix	af_unix: Don't leave consecutive consumed OOB skbs.	2025-10-02 13:39:14 +02:00
vmw_vsock	vmw_vsock: bypass false-positive Wnonnull warning with gcc-16	2026-03-04 07:20:11 -05:00
wireless	wifi: cfg80211: cancel rfkill_block work in wiphy_unregister()	2026-04-18 10:33:19 +02:00
x25	net/x25: fix incorrect parameter validation in the x25_getsockopt() function	2024-03-26 18:21:23 -04:00
xdp	xsk: fix OOB map writes when deleting elements	2024-12-14 19:51:33 +01:00
xfrm	espintcp: fix skb leaks	2026-02-06 16:42:03 +01:00
compat.c	net: Return the correct errno code	2021-06-03 15:13:56 -07:00
devres.c	net: devres: Correct a grammatical error	2021-06-11 12:55:28 -07:00
Kconfig	Remove DECnet support from kernel	2023-06-21 15:59:15 +02:00
Makefile	Remove DECnet support from kernel	2023-06-21 15:59:15 +02:00
socket.c	net: Remove RTNL dance for SIOCBRADDIF and SIOCBRDELIF.	2026-01-19 13:10:11 +01:00
sysctl_net.c	net: Ensure net namespace isolation of sysctls	2021-04-12 13:27:11 -07:00