kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-18 19:12:56 +00:00
Code Issues Releases Packages Activity
linux/net/core
History
Thadeu Lima de Souza Cascardo 9518b79bfd net: fix out-of-bounds access in ops_init 
commit a26ff37e62 upstream.

net_alloc_generic is called by net_alloc, which is called without any
locking. It reads max_gen_ptrs, which is changed under pernet_ops_rwsem. It
is read twice, first to allocate an array, then to set s.len, which is
later used to limit the bounds of the array access.

It is possible that the array is allocated and another thread is
registering a new pernet ops, increments max_gen_ptrs, which is then used
to set s.len with a larger than allocated length for the variable array.

Fix it by reading max_gen_ptrs only once in net_alloc_generic. If
max_gen_ptrs is later incremented, it will be caught in net_assign_generic.

Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@igalia.com>
Fixes: 073862ba5d ("netns: fix net_alloc_generic()")
Reviewed-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Kuniyuki Iwashima <kuniyu@amazon.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20240502132006.3430840-1-cascardo@igalia.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2024-05-17 11:51:05 +02:00
..
bpf_sk_storage.c bpf: Add length check for SK_DIAG_BPF_STORAGE_REQ_MAP_FD parsing 2023-08-11 15:13:50 +02:00
datagram.c net: datagram: fix data-races in datagram_poll() 2023-05-24 17:36:42 +01:00
datagram.h net/core: Allow the compiler to verify declaration and definition consistency 2019-03-27 13:49:44 -07:00
dev.c net: report RCU QS on threaded NAPI repolling 2024-03-26 18:21:37 -04:00
dev_addr_lists.c net: dev_addr_list: handle first address in __hw_addr_add_ex 2021-09-30 13:29:09 +01:00
dev_ioctl.c net: dev: Convert sa_data to flexible array in struct sockaddr 2024-03-01 13:21:59 +01:00
devlink.c devlink: report devlink_port_type_warn source device 2024-03-01 13:21:55 +01:00
drop_monitor.c drop_monitor: Require 'CAP_SYS_ADMIN' when joining "events" group 2023-12-13 18:36:38 +01:00
dst.c ipv6: remove max_size check inline with ipv4 2024-01-15 18:51:25 +01:00
dst_cache.c wireguard: device: reset peer src endpoint when netns exits 2021-12-08 09:04:46 +01:00
failover.c failover: allow name change on IFF_UP slave interfaces 2019-04-10 22:12:26 -07:00
fib_notifier.c net: fib_notifier: propagate extack down to the notifier block callback 2019-10-04 11:10:56 -07:00
fib_rules.c ipv6: fix memory leak in fib6_rule_suppress 2021-12-08 09:04:43 +01:00
filter.c xdp: use flags field to disambiguate broadcast redirect 2024-05-17 11:50:47 +02:00
flow_dissector.c net/core: Fix ETH_P_1588 flow dissector 2023-10-06 13:18:05 +02:00
flow_offload.c netfilter: nf_tables: bail out early if hardware offload is not supported 2022-06-14 18:36:17 +02:00
gen_estimator.c net_sched: gen_estimator: support large ewma log 2021-01-15 18:11:06 -08:00
gen_stats.c docs: networking: convert gen_stats.txt to ReST 2020-04-28 14:39:46 -07:00
gro_cells.c net: Fix data-races around netdev_max_backlog. 2022-08-31 17:16:42 +02:00
hwbm.c net: hwbm: Make the hwbm_pool lock a mutex 2019-06-09 19:40:10 -07:00
link_watch.c net: Write lock dev_base_lock without disabling bottom halves. 2022-06-29 09:03:22 +02:00
lwt_bpf.c lwt: Fix return values of BPF xmit ops 2023-09-19 12:22:33 +02:00
lwtunnel.c lwtunnel: Validate RTA_ENCAP_TYPE attribute length 2022-01-11 15:35:14 +01:00
Makefile of: net: move of_net under net/ 2022-03-08 19:12:41 +01:00
neighbour.c neighbour: Don't let neigh_forced_gc() disable preemption for long 2024-01-25 14:52:29 -08:00
net-procfs.c net-procfs: show net devices bound packet types 2022-02-01 17:27:08 +01:00
net-sysfs.c net: fix data-race in dev_isalive() 2022-06-29 09:03:22 +02:00
net-sysfs.h net-sysfs: add netdev_change_owner() 2020-02-26 20:07:25 -08:00
net-traces.c tcp: add tracepoint for checksum errors 2021-05-14 15:26:03 -07:00
net_namespace.c net: fix out-of-bounds access in ops_init 2024-05-17 11:51:05 +02:00
netclassid_cgroup.c bpf, cgroups: Fix cgroup v2 fallback on v1/v2 mixed mode 2021-09-13 16:35:58 -07:00
netevent.c net: core: Correct function name netevent_unregister_notifier() in the kerneldoc 2021-03-28 17:56:56 -07:00
netpoll.c net: move from strlcpy with unused retval to strscpy 2023-10-25 11:59:01 +02:00
netprio_cgroup.c bpf, cgroups: Fix cgroup v2 fallback on v1/v2 mixed mode 2021-09-13 16:35:58 -07:00
of_net.c of: net: add a helper for loading netdev->dev_addr 2023-07-27 08:46:59 +02:00
page_pool.c page_pool: fix inconsistency for page_pool_ring_[un]lock() 2023-06-05 09:21:22 +02:00
pktgen.c net: pktgen: Fix interface flags printing 2023-10-25 11:58:58 +02:00
ptp_classifier.c bpf: Refactor BPF_PROG_RUN into a function 2021-08-17 00:45:07 +02:00
request_sock.c tcp: make sure init the accept_queue's spinlocks once 2024-02-23 08:54:27 +01:00
rtnetlink.c rtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation 2024-05-17 11:50:58 +02:00
scm.c io_uring/unix: drop usage of io_uring socket 2024-03-26 18:21:11 -04:00
secure_seq.c tcp: Fix data-races around sysctl knobs related to SYN option. 2022-07-29 17:25:22 +02:00
selftests.c net: selftests: add MTU test 2021-07-22 00:52:04 -07:00
skbuff.c net: core: reject skb_copy(_expand) for fraglist GSO skbs 2024-05-17 11:50:50 +02:00
skmsg.c bpf, sockmap: Improved check for empty queue 2024-05-17 11:50:56 +02:00
sock.c net: mark racy access on sk->sk_rcvbuf 2024-05-17 11:50:52 +02:00
sock_destructor.h skb_expand_head() adjust skb->truesize incorrectly 2021-10-22 12:35:51 -07:00
sock_diag.c sock_diag: annotate data-races around sock_diag_handlers[family] 2024-03-26 18:21:17 -04:00
sock_map.c bpf, sockmap: Convert schedule_work into delayed_work 2024-05-17 11:50:56 +02:00
sock_reuseport.c soreuseport: Fix socket selection for SO_INCOMING_CPU. 2022-12-31 13:14:07 +01:00
stream.c net: deal with most data-races in sk_wait_event() 2023-05-24 17:36:42 +01:00
sysctl_net_core.c net: Fix data-races around weight_p and dev_weight_[rt]x_bias. 2022-08-31 17:16:42 +02:00
timestamping.c net: Introduce a new MII time stamping interface. 2019-12-25 19:51:33 -08:00
tso.c net: tso: add UDP segmentation support 2020-06-18 20:46:23 -07:00
utils.c net: Fix skb->csum update in inet_proto_csum_replace16(). 2020-01-24 20:54:30 +01:00
xdp.c xdp: xdp_mem_allocator can be NULL in trace_mem_connect(). 2023-06-05 09:21:23 +02:00