kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-18 19:12:56 +00:00
Code Issues Releases Packages Activity
No description
1,080,199 commits 116 branches 5,798 tags 5.6 GiB
  • C 96.9%
  • Assembly 0.9%
  • Rust 0.6%
  • Shell 0.6%
  • Python 0.5%
  • Other 0.3%
Find a file
Weiming Shi bb03350f97 ipv4: fib: free fib_alias with kfree_rcu() on insert error path 
[ Upstream commit f2f152e94a ]

fib_table_insert() publishes new_fa into the leaf's fa_list with
fib_insert_alias() before calling the fib entry notifiers. When a
notifier fails, the error path removes new_fa with fib_remove_alias()
(hlist_del_rcu) and frees it right away with kmem_cache_free().

fib_table_lookup() walks that list under rcu_read_lock() only, so a
concurrent lookup that already reached new_fa keeps reading it after the
free:

 BUG: KASAN: slab-use-after-free in fib_table_lookup (net/ipv4/fib_trie.c:1601)
 Read of size 1 at addr ffff88810676d4eb by task exploit/297
 Call Trace:
  fib_table_lookup (net/ipv4/fib_trie.c:1601)
  ip_route_output_key_hash_rcu (net/ipv4/route.c:2814)
  ip_route_output_key_hash (net/ipv4/route.c:2705)
  __ip4_datagram_connect (net/ipv4/datagram.c:49)
  udp_connect (net/ipv4/udp.c:2144)
  __sys_connect (net/socket.c:2167)
  __x64_sys_connect (net/socket.c:2173)
  do_syscall_64
  entry_SYSCALL_64_after_hwframe
 which belongs to the cache ip_fib_alias of size 56

Triggering the error path needs CAP_NET_ADMIN and a registered fib
notifier that can reject a route; a netdevsim device whose IPv4 FIB
resource is exhausted is enough.

Free new_fa with alias_free_mem_rcu(), as fib_table_delete() already
does for a fib_alias removed from the trie.

Fixes: a6c76c17df ("ipv4: Notify route after insertion to the routing table")
Reported-by: Xiang Mei <xmei5@asu.edu>
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Weiming Shi <bestswngs@gmail.com>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Link: https://patch.msgid.link/20260704171421.1786806-1-bestswngs@gmail.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
History 2026-08-19 17:13:53 +02:00
arch KVM: VMX: Make vmread_error_trampoline() uncallable from C code 2026-08-19 17:13:52 +02:00
block partitions: aix: bound the pp_count scan to the ppe array 2026-07-24 15:51:24 +02:00
certs X.509: Fix validation of ASN.1 certificate header 2026-07-24 15:51:59 +02:00
crypto crypto: rng - Free default RNG on module exit 2026-07-24 15:51:35 +02:00
Documentation PCI: Move Resizable BAR code to rebar.c 2026-07-24 15:51:58 +02:00
drivers ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF 2026-08-19 17:13:53 +02:00
fs btrfs: fix root leak if its reloc root is unexpected in merge_reloc_roots() 2026-08-19 17:13:52 +02:00
include Bluetooth: L2CAP: Fix regressions caused by reusing ident 2026-07-24 15:52:02 +02:00
init randomize_kstack: Maintain kstack_offset per task 2026-06-19 13:33:41 +02:00
io_uring io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item 2026-07-24 15:51:21 +02:00
ipc ipc/shm: serialize orphan cleanup with shm_nattch updates 2026-06-19 13:33:38 +02:00
kernel futex: Prevent lockup in requeue-PI during signal/ timeout wakeup 2026-08-19 17:13:51 +02:00
lib lib/test_meminit: use && for bools 2026-07-24 15:51:32 +02:00
LICENSES LICENSES/dual/CC-BY-4.0: Git rid of "smart quotes" 2021-07-15 06:31:24 -06:00
mm mm/huge_memory: update file PMD counter before folio_put() 2026-06-19 13:33:49 +02:00
net
samples tracing/events: Fix to check the simple_tsk_fn creation 2026-07-24 15:51:42 +02:00
scripts kconfig: fix potential NULL pointer dereference in conf_askvalue 2026-07-24 15:51:28 +02:00
security apparmor: fix label can not be immediately before a declaration 2026-07-24 15:51:39 +02:00
sound ASoC: tas2562: fix deprecated 'shut-down' GPIO always cleared after lookup 2026-08-19 17:13:53 +02:00
tools bitops: make BYTES_TO_BITS() treewide-available 2026-07-24 15:51:56 +02:00
usr kbuild: hdrcheck: fix cross build with clang 2025-06-27 11:05:22 +01:00
virt KVM: Move kvm_io_bus_get_dev() locking responsibilities to callers 2026-07-24 15:52:02 +02:00
.clang-format clang-format: Update with the latest for_each macro list 2021-05-12 23:32:39 +02:00
.cocciconfig scripts: add Linux .cocciconfig for coccinelle 2016-07-22 12:13:39 +02:00
.get_maintainer.ignore Opt out of scripts/get_maintainer.pl 2019-05-16 10:53:40 -07:00
.gitattributes .gitattributes: use 'dts' diff driver for dts files 2019-12-04 19:44:11 -08:00
.gitignore Remove *.orig pattern from .gitignore 2024-10-17 15:11:10 +02:00
.mailmap mailmap: add Andrej Shadura 2021-10-18 20:22:03 -10:00
COPYING COPYING: state that all contributions really are covered by this file 2020-02-10 13:32:20 -08:00
CREDITS MAINTAINERS: Move Daniel Drake to credits 2021-09-21 08:34:58 +03:00
Kbuild kbuild: rename hostprogs-y/always to hostprogs/always-y 2020-02-04 01:53:07 +09:00
Kconfig kbuild: ensure full rebuild when the compiler is updated 2020-05-12 13:28:33 +09:00
MAINTAINERS staging: rtl8712: Remove driver using deprecated API wext 2025-12-07 06:09:36 +09:00
Makefile Linux 5.15.215 2026-08-07 08:07:31 +02:00
README Drop all 00-INDEX files from Documentation/ 2018-09-09 15:08:58 -06:00

README 

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.