kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-20 19:23:40 +00:00
Code Issues Releases Packages Activity
linux/net
History
Li Xiasong 273ff83c49 tipc: restrict socket queue dumps in enqueue tracepoints 
[ Upstream commit acd7df8d95 ]

tipc_sk_enqueue() runs with sk->sk_lock.slock held while the socket is
owned by user context. The spinlock protects the backlog queue in this
path, but it does not serialize against the socket owner consuming or
purging sk_receive_queue.

KASAN reported:

  CPU: 14 UID: 0 PID: 1050 Comm: tipc3 Not tainted 7.1.0-rc6+ #126 PREEMPT(lazy)
  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
  Call Trace:
    <TASK>
    dump_stack_lvl+0x76/0xa0 lib/dump_stack.c:123
    print_report+0xce/0x5b0 mm/kasan/report.c:482
    kasan_report+0xc6/0x100 mm/kasan/report.c:597
    __asan_report_load4_noabort+0x14/0x30 mm/kasan/report_generic.c:380
    tipc_skb_dump+0x1327/0x16f0 net/tipc/trace.c:73
    tipc_list_dump+0x208/0x2e0 net/tipc/trace.c:187
    tipc_sk_dump+0xaf6/0xd60 net/tipc/socket.c:3996
    trace_event_raw_event_tipc_sk_class+0x312/0x5a0 net/tipc/trace.h:188
    tipc_sk_rcv+0xb1d/0x1d50 net/tipc/socket.c:2497
    tipc_node_xmit+0x1c3/0x1440 net/tipc/node.c:1689
    __tipc_sendmsg+0x97a/0x1440 net/tipc/socket.c:1512
    tipc_sendmsg+0x52/0x80 net/tipc/socket.c:1400
    sock_sendmsg+0x2f6/0x3e0 net/socket.c:825
    splice_to_socket+0x7f9/0x1010 fs/splice.c:884
    do_splice+0xe21/0x2330 fs/splice.c:936
    __do_splice+0x153/0x260 fs/splice.c:1431
    __x64_sys_splice+0x150/0x230 fs/splice.c:1616
    x64_sys_call+0xeb5/0x2790 arch/x86/entry/syscall_64.c:41
    do_syscall_64+0xf3/0x620 arch/x86/entry/syscall_64.c:63
    entry_SYSCALL_64_after_hwframe+0x76/0x7e arch/x86/entry/entry_64.S:130
  RIP: 0033:0x71624e8aafe2
  Code: 08 0f 85 71 3a ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 66 2e 0f 1f 84 00 00 00 00 00 66 2e 0f 1f 84 00 00 00 00 00 66
  RSP: 002b:0000716157ffed68 EFLAGS: 00000246 ORIG_RAX: 0000000000000113
  RAX: ffffffffffffffda RBX: 0000716157fff6c0 RCX: 000071624e8aafe2
  RDX: 000000000000005f RSI: 0000000000000000 RDI: 0000000000000066
  RBP: 0000716157ffed90 R08: 0000000000008000 R09: 0000000000000001
  R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffff00
  R13: 0000000000000021 R14: 0000000000000000 R15: 00007fff89799c40
    </TASK>

The TIPC_DUMP_ALL tracepoints in tipc_sk_enqueue() also dump
sk_receive_queue and can therefore dereference skbs that the socket
owner has already dequeued or freed. Restrict these dumps to
TIPC_DUMP_SK_BKLGQ, which matches the queue protected by the held
spinlock.

Keep the change limited to the enqueue path, where the unsafe queue dump
is reachable while the socket is owned by user context.

Fixes: 01e661ebfb ("tipc: add trace_events for tipc socket")
Cc: stable@vger.kernel.org
Signed-off-by: Li Xiasong <lixiasong1@huawei.com>
Reviewed-by: Tung Nguyen <tung.quang.nguyen@est.tech>
Link: https://patch.msgid.link/20260611135647.3666727-1-lixiasong1@huawei.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2026-08-23 14:17:18 +02:00
..
6lowpan 6lowpan: fix NHC entry use-after-free on error path 2026-07-24 15:51:20 +02:00
9p net/9p: fix infinite loop in p9_client_rpc on fatal signal 2026-07-24 15:51:50 +02:00
802 net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr 2026-06-19 13:33:34 +02:00
8021q net: vlan: sync VLAN features with lower device 2025-12-07 06:09:26 +09:00
appletalk net: appletalk: Fix use-after-free in AARP proxy probe 2025-08-28 16:24:04 +02:00
atm net: atm: reject out-of-range traffic classes in QoS validation 2026-07-24 15:51:46 +02:00
ax25 ax25: properly unshare skbs in ax25_kiss_rcv() 2025-09-09 18:50:20 +02:00
batman-adv batman-adv: clean untagged VLAN on netdev registration failure 2026-07-24 15:51:53 +02:00
bluetooth Bluetooth: 6lowpan: Fix using chan->conn as indication to no remote netdev 2026-08-19 17:14:16 +02:00
bpf bpf: reject short IPv4/IPv6 inputs in bpf_prog_test_run_skb 2026-06-01 17:35:29 +02:00
bpfilter bpfilter: Specify the log level for the kmsg message 2021-06-25 13:13:50 +02:00
bridge netfilter: bridge: release template ct on non-IP path 2026-08-19 17:14:17 +02:00
caif net: caif: clear client service pointer on teardown 2026-06-01 17:35:14 +02:00
can can: j1939: transport: j1939_session_fresh_new(): initialize receive buffer 2026-08-19 17:14:11 +02:00
ceph libceph: tolerate addrvecs with multiple entries of the same type 2026-08-23 14:17:16 +02:00
core xdp: reject clones that overrun skb_shared_info tailroom 2026-08-19 17:14:17 +02:00
dcb net: dcb: choose correct policy to parse DCB_ATTR_BCN 2023-08-11 15:13:53 +02:00
dccp net: fix data-races around sk->sk_forward_alloc 2025-01-23 17:16:04 +01:00
dns_resolver keys, dns: Fix size check of V1 server-list header 2024-01-25 14:52:46 -08:00
dsa net: dsa: tag_ksz: do not rely on skb_mac_header() in TX paths 2026-07-24 15:51:27 +02:00
ethernet gro: remove rcu_read_lock/rcu_read_unlock from gro_complete handlers 2024-09-12 11:07:47 +02:00
ethtool ethtool: eeprom: add more safeties to EEPROM Netlink fallback 2026-06-19 13:33:24 +02:00
hsr net: hsr: fix memory leak on slave unregistration by removing synced VLANs 2026-08-19 17:13:58 +02:00
ieee802154 ieee802154: allow legacy LLSEC ADD/DEL ops to pass strict validation 2026-07-24 15:51:53 +02:00
ife net: ife: require ETH_HLEN to be pullable in ife_decode() 2026-07-24 15:51:46 +02:00
ipv4 bpf, sockmap: Fix sk_redir use-after-free in send verdict 2026-08-19 17:14:17 +02:00
ipv6 ip6_tunnel: clear skb2->cb[] in ip6ip6_err() 2026-08-19 17:14:17 +02:00
iucv net/iucv: fix use-after-free of a severed iucv_path 2026-08-19 17:14:04 +02:00
kcm kcm: use WRITE_ONCE() when changing lower socket callbacks 2026-07-24 15:51:36 +02:00
key net: af_key: initialize alg_key_len for IPComp states 2026-07-24 15:51:21 +02:00
l2tp l2tp: Drop large packets with UDP encap 2026-06-01 17:35:03 +02:00
l3mdev net: Add l3mdev index to flow struct and avoid oif reset for port devices 2024-10-17 15:11:57 +02:00
lapb net: lapb: Use list_for_each_entry() to simplify code in lapb_iface.c 2021-06-08 16:31:25 -07:00
llc llc: fix SAP refcount leak when creating incoming sockets 2026-07-24 15:51:55 +02:00
mac80211 wifi: mac80211: validate individual TWT params before driver setup 2026-08-19 17:14:07 +02:00
mac802154 mac802154: llsec: reject frames shorter than the authentication tag 2026-08-19 17:14:04 +02:00
mctp net: mctp: fix don't require received header reserved bits to be zero 2026-06-19 13:33:41 +02:00
mpls net: mpls: initialize rtm_tos in mpls_getroute() 2026-08-19 17:14:05 +02:00
mptcp mptcp: options: reset DSS fields in case of unexpected size 2026-08-23 14:17:15 +02:00
ncsi net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length 2026-08-19 17:14:14 +02:00
netfilter ipvs: separate destination availability state 2026-08-23 14:17:14 +02:00
netlabel netlabel: validate unlabeled address and mask attribute lengths 2026-06-19 13:33:35 +02:00
netlink rtnetlink: add RTNL_FLAG_DUMP_UNLOCKED flag 2026-07-24 15:51:42 +02:00
netrom netrom: fix double-free in nr_route_frame() 2026-02-06 16:41:58 +01:00
nfc nfc: llcp: protect nfc_llcp_sock_unlink() calls 2026-07-24 15:51:15 +02:00
nsh nsh: Restore skb->{protocol,data,mac_header} for outer header in nsh_gso_segment(). 2024-05-17 11:50:48 +02:00
openvswitch net: openvswitch: reallocate update replies for mismatched IDs 2026-08-19 17:14:15 +02:00
packet net/packet: reset the MAC header on the packet-socket transmit path 2026-08-19 17:14:15 +02:00
phonet phonet: pep: fix use-after-free in pep_get_sb() 2026-08-19 17:14:03 +02:00
psample net: psample: fix info leak in PSAMPLE_ATTR_DATA 2026-07-24 15:51:39 +02:00
qrtr net: qrtr: ns: Raise lookup limit to 128 2026-08-19 17:14:14 +02:00
rds rds: tcp: hold the RCU lock across ipv6_chk_addr() in rds_tcp_laddr_check() 2026-08-19 17:14:06 +02:00
rfkill net: rfkill: prevent unlimited numbers of rfkill events from being created 2026-04-18 10:33:38 +02:00
rose net/rose: fix NULL pointer dereference in rose_transmit_link on reconnect 2026-04-18 10:33:20 +02:00
rxrpc rxrpc: serialize kernel accept preallocation with socket teardown 2026-08-23 14:17:18 +02:00
sched net/sched: act_gact, act_police: range check the fallback control action 2026-08-19 17:14:17 +02:00
sctp sctp: clear new_transport when removing a peer 2026-08-19 17:14:18 +02:00
smc net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot 2026-08-23 14:17:17 +02:00
strparser net: strparser: fix skb_head leak in strp_abort_strp() 2026-06-01 17:35:14 +02:00
sunrpc xprtrdma: Fix bcall rep leak and unbounded peek 2026-07-24 15:51:38 +02:00
switchdev net: make switchdev_bridge_port_{,unoffload} loosely coupled with the bridge 2021-08-04 12:35:07 +01:00
tipc tipc: restrict socket queue dumps in enqueue tracepoints 2026-08-23 14:17:18 +02:00
tls tls: don't abort the connection on signal-interrupted sends 2026-08-19 17:14:14 +02:00
unix af_unix: Reject SIOCATMARK on non-stream sockets 2026-07-04 13:39:37 +02:00
vmw_vsock vsock/virtio: avoid refilling the RX queue after teardown 2026-08-19 17:14:17 +02:00
wireless wifi: cfg80211: bound element ID read when checking non-inheritance 2026-08-19 17:13:53 +02:00
x25 net/x25: fix use-after-free in x25_kill_by_neigh() 2026-08-19 17:14:04 +02:00
xdp xsk: tighten UMEM headroom validation to account for tailroom and min frame 2026-06-01 17:35:02 +02:00
xfrm xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert 2026-08-19 17:13:52 +02:00
compat.c use less confusing names for iov_iter direction initializers 2026-06-19 13:33:46 +02:00
devres.c net: devres: Correct a grammatical error 2021-06-11 12:55:28 -07:00
Kconfig Remove DECnet support from kernel 2023-06-21 15:59:15 +02:00
Makefile Remove DECnet support from kernel 2023-06-21 15:59:15 +02:00
socket.c net: Drop the lock in skb_may_tx_timestamp() 2026-07-24 15:51:21 +02:00
sysctl_net.c net: Ensure net namespace isolation of sysctls 2021-04-12 13:27:11 -07:00