kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-16 22:39:48 +00:00
Code Issues Releases Packages Activity
linux/net
History
Eric Dumazet f157cc1d72 net: fix socket refcounting in skb_complete_tx_timestamp() 
[ Upstream commit 9ac25fc063 ]

TX skbs do not necessarily hold a reference on skb->sk->sk_refcnt
By the time TX completion happens, sk_refcnt might be already 0.

sock_hold()/sock_put() would then corrupt critical state, like
sk_wmem_alloc and lead to leaks or use after free.

Fixes: 62bccb8cdb ("net-timestamp: Make the clone operation stand-alone from phy timestamping")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Alexander Duyck <alexander.h.duyck@intel.com>
Cc: Johannes Berg <johannes@sipsolutions.net>
Cc: Soheil Hassas Yeganeh <soheil@google.com>
Cc: Willem de Bruijn <willemb@google.com>
Acked-by: Soheil Hassas Yeganeh <soheil@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2017-03-22 12:43:33 +01:00
..
6lowpan 6lowpan: ndisc: no overreact if no short address is available 2016-09-19 20:19:34 +02:00
9p IB/core: add support to create a unsafe global rkey to ib_create_pd 2016-09-23 13:47:44 -04:00
802 net: Kill dev_rebuild_header 2015-03-02 16:43:41 -05:00
8021q net: add recursion limit to GRO 2016-10-20 14:32:22 -04:00
appletalk appletalk: use IS_ENABLED() instead of checking for built-in or module 2016-09-10 21:19:10 -07:00
atm lec: use IS_ENABLED() instead of checking for built-in or module 2016-09-10 21:19:10 -07:00
ax25 ax25: Fix segfault after sock connection timeout 2017-02-04 09:47:09 +01:00
batman-adv batman-adv: Check for alloc errors when preparing TT local data 2016-12-02 10:46:59 +01:00
bluetooth Bluetooth: Fix using the correct source address type 2016-11-22 22:50:46 +01:00
bridge net: bridge: allow IPv6 when multicast flood is disabled 2017-03-22 12:43:32 +01:00
caif net: caif: remove ineffective check 2016-12-05 14:48:48 -05:00
can can: Fix kernel panic at security_sock_rcv_skb 2017-02-18 15:11:40 +01:00
ceph ceph: update readpages osd request according to size of pages 2017-03-12 06:41:53 +01:00
core net: fix socket refcounting in skb_complete_tx_timestamp() 2017-03-22 12:43:33 +01:00
dcb net: dcb: set error code on failures 2016-12-03 23:54:25 -05:00
dccp dccp: Unlock sock before calling sk_free() 2017-03-22 12:43:33 +01:00
decnet net: fix decnet rtnexthop parsing 2016-07-05 14:08:47 -07:00
dns_resolver KEYS: Add a facility to restrict new links into a keyring 2016-04-11 22:37:37 +01:00
dsa net: dsa: Do not destroy invalid network devices 2017-02-18 15:11:43 +01:00
ethernet net: introduce device min_header_len 2017-02-18 15:11:43 +01:00
hsr net/hsr: Remove unused but set variable 2016-10-18 10:28:18 -04:00
ieee802154 ieee802154: 6lowpan: fix intra pan id check 2016-07-08 13:23:12 +02:00
ipv4 tcp: fix various issues for sockets morphing to listen state 2017-03-22 12:43:33 +01:00
ipv6 ipv6: orphan skbs in reassembly unit 2017-03-22 12:43:33 +01:00
ipx net: Pass kern from net_proto_family.create to sk_alloc 2015-05-11 10:50:17 -04:00
irda irda: Fix lockdep annotations in hashbin_delete(). 2017-02-26 11:10:51 +01:00
iucv net/af_iucv: don't use paged skbs for TX on HiperSockets 2017-01-19 20:18:04 +01:00
kcm kcm: fix a null pointer dereference in kcm_sendmsg() 2017-02-26 11:10:50 +01:00
key af_key: fix two typos 2015-10-23 03:05:19 -07:00
l2tp l2tp: avoid use-after-free caused by l2tp_ip_backlog_recv 2017-03-22 12:43:32 +01:00
l3mdev net: ipv6: Remove l3mdev_get_saddr6 2016-09-10 23:12:53 -07:00
lapb net/lapb: tuse %*ph to dump buffers 2016-05-29 22:33:25 -07:00
llc net/llc: avoid BUG_ON() in skb_orphan() 2017-02-26 11:10:50 +01:00
mac80211 mac80211: use driver-indicated transmitter STA only for data frames 2017-03-15 10:02:48 +08:00
mac802154 mac802154: use rate limited warnings for malformed frames 2016-09-19 20:19:34 +02:00
mpls net: Specify the owning module for lwtunnel ops 2017-02-04 09:47:11 +01:00
ncsi net/ncsi: Improve HNCDSC AEN handler 2016-10-20 11:23:08 -04:00
netfilter netfilter: conntrack: refine gc worker heuristics, redux 2017-03-12 06:41:53 +01:00
netlabel netlabel: Implement CALIPSO config functions for SMACK. 2016-06-27 15:06:18 -04:00
netlink netlink: Do not schedule work from sk_destruct 2016-12-05 19:43:42 -05:00
netrom netfilter: Remove spurios included of netfilter.h 2015-06-18 21:14:32 +02:00
nfc NFC: digital: Fix RTOX supervisor PDU handling 2016-07-11 02:02:03 +02:00
openvswitch ipv6: orphan skbs in reassembly unit 2017-03-22 12:43:33 +01:00
packet net: don't call strlen() on the user buffer in packet_bind_spkt() 2017-03-22 12:43:32 +01:00
phonet sock: struct proto hash function may error 2016-02-11 03:54:14 -05:00
qrtr Merge tag 'qcom-soc-for-4.7-2' into net-next 2016-05-17 14:11:19 -04:00
rds RDS: TCP: unregister_netdevice_notifier() in error path of rds_tcp_init_net 2016-12-02 13:29:26 -05:00
rfkill rfkill: Use switch to demux userspace operations 2016-04-05 10:48:53 +02:00
rose rose: limit sk_filter trim to payload 2016-07-13 11:53:40 -07:00
rxrpc rxrpc: Fix checking of error from ip6_route_output() 2016-10-13 08:43:17 +01:00
sched net sched actions: decrement module reference count after table flush. 2017-03-22 12:43:32 +01:00
sctp tcp: don't annotate mark on control socket from tcp_v6_send_response() 2017-02-18 15:11:44 +01:00
strparser strparser: destroy workqueue on module exit 2017-03-22 12:43:33 +01:00
sunrpc xprtrdma: Reduce required number of send SGEs 2017-03-12 06:41:52 +01:00
switchdev switchdev: Execute bridge ndos only for bridge ports 2016-10-19 10:58:04 -04:00
tipc tipc: check minimum bearer MTU 2016-12-02 14:03:20 -05:00
unix af_unix: move unix_mknod() out of bindlock 2017-02-04 09:47:10 +01:00
vmw_vsock vsock/virtio: fix src/dst cid format 2017-01-09 08:32:23 +01:00
wimax net:wimax: Fix doucble word "the the" in networking.xml 2015-08-09 22:43:52 -07:00
wireless nl80211: Fix mesh HT operation check 2017-02-14 15:25:37 -08:00
x25 net: x25: remove null checks on arrays calling_ae and called_ae 2016-09-09 18:13:30 -07:00
xfrm xfrm_user: fix return value from xfrm_user_rcv_msg 2016-11-30 10:58:53 +01:00
compat.c packet: compat support for sock_fprog 2016-06-09 23:41:03 -07:00
Kconfig strparser: Stream parser for messages 2016-08-17 19:36:23 -04:00
Makefile strparser: Stream parser for messages 2016-08-17 19:36:23 -04:00
socket.c net: socket: fix recvmmsg not returning error from sock_error 2017-02-26 11:10:51 +01:00
sysctl_net.c Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace 2016-10-06 09:52:23 -07:00