kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-18 19:12:56 +00:00
Code Issues Releases Packages Activity
No description
1,080,475 commits 116 branches 5,798 tags 5.6 GiB
  • C 96.9%
  • Assembly 0.9%
  • Rust 0.6%
  • Shell 0.6%
  • Python 0.5%
  • Other 0.3%
Find a file
David Lee f9d6cabff1 netfilter: ipset: do not update comments from kernel-side hash adds 
commit f30415929b upstream.

mtype_resize() copies comment pointers with memcpy(), not the comment
objects themselves. During the window after an entry has been copied but
before the table swap and backlog replay, the old table is still
published for packet-side updates while the replacement-table entry
already holds the same ip_set_comment_rcu pointer.

If xt_SET --add-set ... --exist hits that old entry in this window,
mtype_add() calls ip_set_init_comment() even though packet-side adds
carry no comment payload. That call frees the shared comment through the
old entry, so the replacement-table entry now holds a stale pointer.
When the queued add is replayed on the new table, mtype_add() calls
ip_set_init_comment() again and strlen() dereferences the stale pointer.

Fix this in mtype_add() by skipping ip_set_init_comment() when
ext->target marks a packet-side add. Userspace adds still update
comments, while packet-side adds can no longer free comment storage
shared with a resize copy.

Fixes: f66ee0410b ("netfilter: ipset: Fix "INFO: rcu detected stall in hash_xxx" reports")
Cc: stable@vger.kernel.org
Signed-off-by: David Lee <david.lee@trailofbits.com>
Assisted-by: Codex:gpt-5.5
Acked-by: Jozsef Kadlecsik <kadlec@netfilter.org>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2026-08-19 17:14:09 +02:00
arch powerpc/boot: Fix treeboot-akebono CPU node lookup check 2026-08-19 17:14:07 +02:00
block partitions: aix: bound the pp_count scan to the ppe array 2026-07-24 15:51:24 +02:00
certs X.509: Fix validation of ASN.1 certificate header 2026-07-24 15:51:59 +02:00
crypto crypto: rsa-pkcs1pad: Don't WARN on an empty digest 2026-08-19 17:13:55 +02:00
Documentation PCI: Move Resizable BAR code to rebar.c 2026-07-24 15:51:58 +02:00
drivers igbvf: Fix leak in TX DMA error cleanup 2026-08-19 17:14:09 +02:00
fs smb: client: fix buffer leaks in SMB1 read and write 2026-08-19 17:14:07 +02:00
include dmaengine: qcom: bam_dma: Fix command element mask field for BAM v1.6.0+ 2026-08-19 17:14:09 +02:00
init randomize_kstack: Maintain kstack_offset per task 2026-06-19 13:33:41 +02:00
io_uring io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item 2026-07-24 15:51:21 +02:00
ipc ipc/shm: serialize orphan cleanup with shm_nattch updates 2026-06-19 13:33:38 +02:00
kernel audit: fix potential use-after-free in audit_del_rule() 2026-08-19 17:14:08 +02:00
lib rhashtable: clear stale iter->p on table restart 2026-08-19 17:14:08 +02:00
LICENSES LICENSES/dual/CC-BY-4.0: Git rid of "smart quotes" 2021-07-15 06:31:24 -06:00
mm mm/hugetlb: fix list corruption in allocate_file_region_entries() 2026-08-19 17:14:08 +02:00
net netfilter: ipset: do not update comments from kernel-side hash adds 2026-08-19 17:14:09 +02:00
samples tracing/events: Fix to check the simple_tsk_fn creation 2026-07-24 15:51:42 +02:00
scripts kconfig: fix potential NULL pointer dereference in conf_askvalue 2026-07-24 15:51:28 +02:00
security keys: make keyring key-chunk byte order agree with keyring_diff_objects() 2026-08-19 17:14:06 +02:00
sound ALSA: usb-audio: Clamp frame size in implicit-feedback mode 2026-08-19 17:14:09 +02:00
tools bitops: make BYTES_TO_BITS() treewide-available 2026-07-24 15:51:56 +02:00
usr kbuild: hdrcheck: fix cross build with clang 2025-06-27 11:05:22 +01:00
virt KVM: Move kvm_io_bus_get_dev() locking responsibilities to callers 2026-07-24 15:52:02 +02:00
.clang-format clang-format: Update with the latest for_each macro list 2021-05-12 23:32:39 +02:00
.cocciconfig scripts: add Linux .cocciconfig for coccinelle 2016-07-22 12:13:39 +02:00
.get_maintainer.ignore Opt out of scripts/get_maintainer.pl 2019-05-16 10:53:40 -07:00
.gitattributes .gitattributes: use 'dts' diff driver for dts files 2019-12-04 19:44:11 -08:00
.gitignore Remove *.orig pattern from .gitignore 2024-10-17 15:11:10 +02:00
.mailmap mailmap: add Andrej Shadura 2021-10-18 20:22:03 -10:00
COPYING COPYING: state that all contributions really are covered by this file 2020-02-10 13:32:20 -08:00
CREDITS MAINTAINERS: Move Daniel Drake to credits 2021-09-21 08:34:58 +03:00
Kbuild kbuild: rename hostprogs-y/always to hostprogs/always-y 2020-02-04 01:53:07 +09:00
Kconfig kbuild: ensure full rebuild when the compiler is updated 2020-05-12 13:28:33 +09:00
MAINTAINERS staging: rtl8712: Remove driver using deprecated API wext 2025-12-07 06:09:36 +09:00
Makefile Linux 5.15.215 2026-08-07 08:07:31 +02:00
README Drop all 00-INDEX files from Documentation/ 2018-09-09 15:08:58 -06:00

README 

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.