github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-10-06 10:36:03 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph
0958ea4355
linux/net
History
Ilya Maximets dad19b59da net/sched: act_ct: fix helper UAF due to extensions realloc 
While calling the helpers, a raw pointer to the extensions area is
wired into expectations list:

  -> nf_ct_helper()
   -> helper->help()
    -> nf_ct_expect_related_report()
     -> nf_ct_expect_insert()
      -> hlist_add_head_rcu(&exp->lnode, &master_help->expectations)

In case the connection is not confirmed yet, more extensions can be
added afterwards with *_ext_add() calls reallocating the extension
space and leaving the now invalid pointer in the expectations list
that is later accessed while removing the expectation.

Make sure that helpers are called at the end after all the other
extensions are already added.

Note that the helper rejection now leaves the mark and labels set,
but that's not different from how the NAT was handled before or how
the mark and the labels were handled on confirmation failure.  And
there are no atomicity guarantees provided by the API anyway.

Fixes: a21b06e731 ("net: sched: add helper support in act_ct")
Cc: stable@vger.kernel.org
Reported-by: Axel Mierczuk <axel.mierczuk@1password.com>
Signed-off-by: Ilya Maximets <i.maximets@ovn.org>
Reviewed-by: Xin Long <lucien.xin@gmail.com>
Reviewed-by: Jamal Hadi Salim <jhs@mojatatu.com>
Reviewed-by: Aaron Conole <aconole@redhat.com>
Link: https://patch.msgid.link/20260921145655.3167436-7-i.maximets@ovn.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-09-24 09:56:02 -07:00
..
6lowpan net: 6lowpan: fix mismatched comments 2026-09-02 09:03:06 +02:00
9p 9p: Add missing read barrier in virtio zero-copy path 2026-06-21 05:22:57 +00:00
802 appletalk: move the protocol out of tree 2026-06-16 14:37:06 -07:00
8021q vlan: fix skb_under_panic and races when toggling HW VLAN offload 2026-08-20 13:05:43 -07:00
atm pppoatm: ensure a writable skb header and linear data 2026-09-15 17:07:01 -07:00
batman-adv treewide: refresh kmalloc_obj() conversions 2026-09-04 21:37:00 -07:00
bluetooth Bluetooth: RFCOMM: Reject short EA=0 frames in rfcomm_recv_frame() 2026-09-21 09:37:20 -04:00
bpf bpf: Fix partial copy of non-linear test_run output 2026-06-21 17:55:06 -07:00
bridge net: bridge: mdb: restart port group walk after deletion 2026-09-23 16:51:03 -07:00
can can: isotp: check register_netdevice_notifier() error in module init 2026-07-29 11:26:41 +02:00
ceph libceph: remove pinning assertion in ceph_msg_data_iter_next() 2026-09-02 12:23:05 +02:00
core net: xps: reject an out of range traffic class 2026-09-23 19:39:38 -07:00
dcb
devlink treewide: refresh kmalloc_obj() conversions 2026-09-04 21:37:00 -07:00
dns_resolver keys, dns: Drop unused NUL terminator from upayload->data 2026-08-10 16:20:42 -07:00
dsa net: dsa: tag_brcm: legacy FCS: request needed tailroom 2026-09-09 13:31:08 -07:00
ethernet bonding: prevent potential infinite loop in bond_header_parse() 2026-03-16 19:29:45 -07:00
ethtool net: ethtool: keep rtnl_lock for the ioctl self test 2026-09-18 17:19:15 -07:00
handshake handshake: Require admin permission for DONE command 2026-06-12 15:45:44 -07:00
hsr net: hsr: enable promiscuous mode on interlink port with fwd offload 2026-09-10 08:45:00 -07:00
ieee802154 ieee802154: 6lowpan: fix NULL dereference in lowpan_newlink 2026-09-02 09:54:27 +02:00
ife net/sched: act_ife: Only operate on Ethernet frames 2026-08-24 11:59:59 -07:00
ipv4 tcp: fix use-after-free of retransmit_skb_hint in tcp_send_synack() 2026-09-24 09:17:10 -07:00
ipv6 ipv6: sr: enforce exact attribute length for SEG6_ATTR_DST 2026-09-23 18:34:13 -07:00
iucv net/iucv: fix the recvmsg window update 2026-08-31 15:51:22 -07:00
kcm net: kcm: Hold RCU read lock while running BPF parser 2026-08-17 13:43:58 -07:00
key ipsec-2026-06-22 2026-06-23 16:22:24 -07:00
l2tp net: l2tp: do not propagate multicast notification errors 2026-08-24 11:43:28 -07:00
l3mdev
lapb
llc llc: fix SAP refcount leak when creating incoming sockets 2026-07-17 13:17:46 +02:00
mac80211 Many fixes: 2026-09-16 15:54:56 -07:00
mac802154 mac802154: fix use-after-free of sdata via queued RX frames 2026-09-03 11:00:54 +02:00
mctp mctp: route: iterate socket tag list in mctp_lookup_prealloc_tag() 2026-09-24 09:11:56 -07:00
mpls Summary 2026-08-20 08:46:41 -07:00
mptcp mptcp: fix bad accounting in __mptcp_subflow_push_pending() 2026-09-17 08:14:33 -07:00
ncsi net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length 2026-08-05 17:24:57 -07:00
netfilter netfilter: nf_tables: skip expired catchall elements on insert and delete 2026-09-18 11:24:05 +02:00
netlabel Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2026-06-11 14:33:35 -07:00
netlink genetlink: report the real command id for dump-only ops in policy dumps 2026-09-22 15:21:32 +02:00
nfc nfc: llcp: fix slab-out-of-bounds reads when logging service names 2026-09-23 22:13:17 +02:00
nsh
openvswitch net: openvswitch: conntrack: fix helper UAF due to extensions realloc 2026-09-24 09:56:01 -07:00
packet packet: use ubuf_info completion for TX_RING packets 2026-09-22 18:32:57 -07:00
phonet phonet: pep: convert getsockopt to sockopt_t 2026-08-03 16:55:23 -07:00
psample net: psample: fix info leak in PSAMPLE_ATTR_DATA 2026-06-17 16:35:50 -07:00
psp net: psp: avoid conflicts with skb->decrypted and sk_validate_xmit_skb() 2026-09-16 19:18:24 -07:00
qrtr net: qrtr: Send HELLO message on endpoint register 2026-09-02 12:14:32 +01:00
rds rds: ib: Clear the sg list when mapping an MR fails 2026-09-24 13:18:19 +02:00
rfkill Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
rxrpc treewide: refresh kmalloc_obj() conversions 2026-09-04 21:37:00 -07:00
sched net/sched: act_ct: fix helper UAF due to extensions realloc 2026-09-24 09:56:02 -07:00
sctp sctp: hold asoc or transport before mod_timer() in timer handlers 2026-09-22 18:36:36 -07:00
shaper net: shaper: add a note that we expect cap dumps to be tiny 2026-06-11 12:55:23 +02:00
smc Including fixes from Bluetooth, IPSec and Netfilter. 2026-08-27 13:53:43 -07:00
strparser net: strparser: fix skb_head leak in strp_abort_strp() 2026-04-14 12:37:00 +02:00
sunrpc treewide: refresh kmalloc_obj() conversions 2026-09-04 21:37:00 -07:00
switchdev bridge: No DEV_PATH_BR_VLAN_UNTAG_HW for dsa foreign 2026-03-19 13:14:00 +01:00
tipc tipc: reject invalid and unexpected GRP_ACK_MSG to prevent bc_ackers underflow 2026-09-18 15:42:47 -07:00
tls tls: device: fix out-of-bounds write in tls_append_frag() 2026-08-25 10:04:02 +02:00
unix af_unix: Unify scc_index when finalising SCC in __unix_walk_scc(). 2026-09-15 16:45:05 -07:00
vmw_vsock vsock: ignore empty child namespace mode writes 2026-09-17 19:06:31 -07:00
wireless Many fixes: 2026-09-16 15:54:56 -07:00
x25 net/x25: fix use-after-free of the socket by its timers 2026-07-30 18:46:45 -07:00
xdp xsk: honor XDP_TX_METADATA in zero-copy path 2026-08-24 11:12:00 -07:00
xfrm ipsec-2026-09-16 2026-09-16 15:54:19 -07:00
compat.c net: af_unix: useful handling of LSM denials on SCM_RIGHTS 2026-08-17 18:14:52 -07:00
devres.c
Kconfig appletalk: move the protocol out of tree 2026-06-16 14:37:06 -07:00
Kconfig.debug
Makefile appletalk: move the protocol out of tree 2026-06-16 14:37:06 -07:00
socket.c Major changes: 2026-08-20 07:36:20 -07:00
sysctl_net.c net: enforce net sysctl registration 2026-08-13 13:12:21 +02:00