kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-11-08 18:57:22 +00:00
Code Issues Releases Packages Activity
No description
1,325,853 commits 117 branches 5,824 tags 6.2 GiB
  • C 96.8%
  • Assembly 0.9%
  • Rust 0.7%
  • Shell 0.6%
  • Python 0.5%
  • Other 0.3%
Find a file
Inseo An f3fe58ce37 netfilter: nf_tables: fix use-after-free in nf_tables_addchain() 
[ Upstream commit 71e99ee20f ]

nf_tables_addchain() publishes the chain to table->chains via
list_add_tail_rcu() (in nft_chain_add()) before registering hooks.
If nf_tables_register_hook() then fails, the error path calls
nft_chain_del() (list_del_rcu()) followed by nf_tables_chain_destroy()
with no RCU grace period in between.

This creates two use-after-free conditions:

 1) Control-plane: nf_tables_dump_chains() traverses table->chains
    under rcu_read_lock(). A concurrent dump can still be walking
    the chain when the error path frees it.

 2) Packet path: for NFPROTO_INET, nf_register_net_hook() briefly
    installs the IPv4 hook before IPv6 registration fails.  Packets
    entering nft_do_chain() via the transient IPv4 hook can still be
    dereferencing chain->blob_gen_X when the error path frees the
    chain.

Add synchronize_rcu() between nft_chain_del() and the chain destroy
so that all RCU readers -- both dump threads and in-flight packet
evaluation -- have finished before the chain is freed.

Fixes: 91c7b38dc9 ("netfilter: nf_tables: use new transaction infrastructure to handle chain")
Signed-off-by: Inseo An <y0un9sa@gmail.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
History 2026-03-04 07:20:38 -05:00
arch arm64: dts: qcom: sm6115: Add CX_MEM/DBGC GPU regions 2026-03-04 07:19:47 -05:00
block block: add a bio_add_virt_nofail helper 2026-03-04 07:19:26 -05:00
certs sign-file,extract-cert: use pkcs11 provider for OPENSSL MAJOR >= 3 2024-09-20 19:52:48 +03:00
crypto crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec 2026-01-30 10:28:39 +01:00
Documentation Documentation: tracing: Add PCI tracepoint documentation 2026-03-04 07:19:59 -05:00
drivers xen-netback: reject zero-queue configuration from guest 2026-03-04 07:20:37 -05:00
fs fs/ntfs3: Fix slab-out-of-bounds read in DeleteIndexEntryRoot 2026-03-04 07:20:34 -05:00
include clk: Move clk_{save,restore}_context() to COMMON_CLK section 2026-03-04 07:20:27 -05:00
init init: handle bootloader identifier in kernel parameters 2025-10-19 16:33:50 +02:00
io_uring io_uring/cancel: de-unionize file and user_data in struct io_cancel_data 2026-03-04 07:20:34 -05:00
ipc ipc: don't audit capability check in ipc_permissions() 2026-03-04 07:20:07 -05:00
kernel tracing: Remove duplicate ENABLE_EVENT_STR and DISABLE_EVENT_STR macros 2026-03-04 07:20:25 -05:00
lib objpool: fix the overestimation of object pooling metadata size 2026-03-04 07:20:35 -05:00
LICENSES LICENSES: add 0BSD license text 2024-09-01 20:43:24 -07:00
mm mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather 2026-02-19 16:29:55 +01:00
net
rust rust: rbtree: fix documentation typo in CursorMut peek_next method 2026-02-06 16:55:44 +01:00
samples samples/ftrace: Adjust LoongArch register restore order in direct calls 2026-01-08 10:14:50 +01:00
scripts scripts: generate_rust_analyzer: Add compiler_builtins -> core dep 2026-02-06 16:55:47 +01:00
security evm: Use ordered xattrs list to calculate HMAC in evm_init_hmac() 2026-03-04 07:19:56 -05:00
sound ASoC: nau8821: Fixup nau8821_enable_jack_detect() 2026-03-04 07:19:52 -05:00
tools selftests: forwarding: vxlan_bridge_1d_ipv6: fix test failure with br_netfilter enabled 2026-03-04 07:20:37 -05:00
usr kbuild: uapi: Strip comments before size type check 2025-11-13 15:34:35 -05:00
virt KVM: Don't clobber irqfd routing type when deassigning irqfd 2026-02-11 13:40:17 +01:00
.clang-format clang-format: Update with v6.11-rc1's for_each macro list 2024-08-02 13:20:31 +02:00
.clippy.toml rust: give Clippy the minimum supported Rust version 2025-08-01 09:48:44 +01:00
.cocciconfig
.editorconfig .editorconfig: remove trim_trailing_whitespace option 2024-06-13 16:47:52 +02:00
.get_maintainer.ignore Add Jeff Kirsher to .get_maintainer.ignore 2024-03-08 11:36:54 +00:00
.gitattributes .gitattributes: set diff driver for Rust source code files 2023-05-31 17:48:25 +02:00
.gitignore rust: introduce .clippy.toml 2025-03-13 13:01:42 +01:00
.mailmap mailmap: add entry for Thorsten Blum 2024-11-07 14:14:59 -08:00
.rustfmt.toml rust: add .rustfmt.toml 2022-09-28 09:02:20 +02:00
COPYING
CREDITS MAINTAINERS: Remove self from DSA entry 2024-11-03 12:52:38 -08:00
Kbuild Kbuild updates for v6.1 2022-10-10 12:00:45 -07:00
Kconfig
MAINTAINERS gpiolib-acpi: Update file references in the Documentation and MAINTAINERS 2026-02-11 13:40:29 +01:00
Makefile kbuild: Add objtool to top-level clean target 2026-03-04 07:20:35 -05:00
README README: Fix spelling 2024-03-18 03:36:32 -06:00

README 

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the reStructuredText markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.