github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-20 09:40:02 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph
f4c3d89fc9
linux/net
History
Eric Dumazet f4c3d89fc9 tipc: fix UAF in tipc_l2_send_msg() 
Syzbot reported a slab-use-after-free in ipvlan_hard_header() when
called from tipc_l2_send_msg().

The root cause is that tipc_disable_l2_media() calls synchronize_net()
while b->media_ptr is still valid. This allows concurrent RCU readers
to obtain the device pointer after synchronize_net() has finished.
The pointer is cleared later in bearer_disable(), but without any
subsequent synchronization, allowing the device to be freed while
still in use by readers.

Fix this by clearing b->media_ptr in tipc_disable_l2_media() before
calling synchronize_net().

This is safe to do now because the call order in bearer_disable()
was reversed in 0d051bf93c ("tipc: make bearer packet filtering generic")
to call tipc_node_delete_links() (which needs the pointer) before
disable_media().

Fixes: 282b3a0562 ("tipc: send out RESET immediately when link goes down")
https: //lore.kernel.org/netdev/6a2c1007.428ffe26.258b27.015d.GAE@google.com/T/#u
Reported-by: syzbot+64ec81389cbad56a8c35@syzkaller.appspotmail.com
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Jon Maloy <jmaloy@redhat.com>
Reviewed-by: Tung Nguyen <tung.quang.nguyen@est.tech>
Link: https://patch.msgid.link/20260612135949.4010482-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-15 12:50:29 -07:00
..
6lowpan 6lowpan: fix NHC entry use-after-free on error path 2026-06-11 15:27:07 -07:00
9p 9p/trans_xen: replace simple_strto* with kstrtouint 2026-04-16 02:57:01 +00:00
802 net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr 2026-06-04 08:52:41 -07:00
8021q 8021q: delete cleared egress QoS mappings 2026-04-23 12:13:57 +02:00
appletalk appletalk: aarp: zero-initialize aarp_entry to prevent heap info leak 2026-06-03 18:08:58 -07:00
atm net: atm: reject out-of-range traffic classes in QoS validation 2026-06-12 16:33:36 -07:00
batman-adv batman-adv: bla: avoid NULL-ptr deref for claim via dropped interface 2026-05-19 10:43:54 +02:00
bluetooth Bluetooth: MGMT: Fix backward compatibility with userspace 2026-06-03 11:24:12 -04:00
bpf bpf: reject short IPv4/IPv6 inputs in bpf_prog_test_run_skb 2026-04-12 15:42:57 -07:00
bridge bridge: cfm: reject invalid CCM interval at configuration time 2026-06-11 15:16:12 -07:00
can Networking changes for 7.1. 2026-04-14 18:36:10 -07:00
ceph libceph: Fix potential null-ptr-deref in decode_choose_args() 2026-05-12 21:00:59 +02:00
core net: watchdog: fix refcount tracking races 2026-06-12 17:34:57 -07:00
dcb Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
devlink devlink: Release nested relation on devlink free 2026-06-01 19:54:52 -07:00
dns_resolver net: Add SPDX ids to some source files 2026-03-09 18:32:45 -07:00
dsa net: dsa: remove redundant netdev_lock_ops() from conduit ethtool ops 2026-04-16 19:10:48 -07:00
ethernet bonding: prevent potential infinite loop in bond_header_parse() 2026-03-16 19:29:45 -07:00
ethtool ethtool: eeprom: add more safeties to EEPROM Netlink fallback 2026-05-27 17:42:09 -07:00
handshake net/handshake: Drain pending requests at net namespace exit 2026-05-28 13:35:32 +02:00
hsr hsr: Remove WARN_ONCE() in hsr_addr_is_self(). 2026-06-02 12:04:52 -07:00
ieee802154 ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit() 2026-06-04 08:51:32 -07:00
ife net: ife: require ETH_HLEN to be pullable in ife_decode() 2026-06-13 17:34:39 -07:00
ipv4 tcp: clear sock_ops cb flags before force-closing a child socket 2026-06-12 16:18:39 -07:00
ipv6 netfilter pull request 26-06-10 2026-06-11 12:30:00 +02:00
iucv net/iucv: fix locking in .getsockopt 2026-05-22 17:40:32 -07:00
kcm kcm: use WRITE_ONCE() when changing lower socket callbacks 2026-06-14 10:18:14 +02:00
key xfrm: route MIGRATE notifications to caller's netns 2026-05-07 09:31:10 +02:00
l2tp l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl() 2026-06-01 19:40:46 -07:00
l3mdev
lapb treewide: Replace kmalloc with kmalloc_obj for non-scalar types 2026-02-21 01:02:28 -08:00
llc llc: Return -EINPROGRESS from llc_ui_connect() 2026-04-23 11:40:39 -07:00
mac80211 wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap 2026-06-02 13:26:33 +02:00
mac802154 bonding: prevent potential infinite loop in bond_header_parse() 2026-03-16 19:29:45 -07:00
mctp net: mctp: test: Use dev_direct_xmit for TX to our test device 2026-04-30 13:36:47 -07:00
mpls Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2026-04-02 11:03:13 -07:00
mptcp mptcp: add-addr: always drop other suboptions 2026-06-03 19:04:27 -07:00
ncsi net: ncsi: fix skb leak in error paths 2026-03-06 17:34:48 -08:00
netfilter netfilter: nft_fib: fix stale stack leak via the OIFNAME register 2026-06-10 18:00:19 +02:00
netlabel netlabel: validate unlabeled address and mask attribute lengths 2026-06-05 19:05:06 -07:00
netlink net: netlink: don't set nsid on local notifications 2026-05-22 17:11:09 -07:00
nfc nfc: hci: fix out-of-bounds read in HCP header parsing 2026-05-07 12:42:09 +02:00
nsh
openvswitch net: openvswitch: fix possible kfree_skb of ERR_PTR 2026-06-08 20:13:02 -07:00
packet net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd() 2026-04-22 20:16:34 -07:00
phonet net: phonet: free phonet_device after RCU grace period 2026-06-08 17:37:07 -07:00
psample treewide: Replace kmalloc with kmalloc_obj for non-scalar types 2026-02-21 01:02:28 -08:00
psp psp: strip variable-length PSP header in psp_dev_rcv() 2026-05-04 19:25:14 -07:00
qrtr net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() 2026-06-12 18:42:53 -07:00
rds rds: mark snapshot pages dirty in rds_info_getsockopt() 2026-06-10 08:18:16 -07:00
rfkill net: rfkill: prevent unlimited numbers of rfkill events from being created 2026-04-07 12:35:04 +02:00
rxrpc rxrpc: serialize kernel accept preallocation with socket teardown 2026-06-12 16:48:55 -07:00
sched net/sched: sch_dualpi2: Add missing module alias 2026-06-12 17:59:32 -07:00
sctp sctp: validate embedded address parameter length 2026-06-11 15:18:08 -07:00
shaper net: shaper: rework the VALID marking (again) 2026-05-20 16:34:20 -07:00
smc net/smc: Do not re-initialize smc hashtables 2026-05-22 17:38:02 -07:00
strparser net: strparser: fix skb_head leak in strp_abort_strp() 2026-04-14 12:37:00 +02:00
sunrpc nfsd-7.1 fixes: 2026-05-26 13:49:13 -07:00
switchdev bridge: No DEV_PATH_BR_VLAN_UNTAG_HW for dsa foreign 2026-03-19 13:14:00 +01:00
tipc tipc: fix UAF in tipc_l2_send_msg() 2026-06-15 12:50:29 -07:00
tls tls: Preserve sk_err across recvmsg() when data has been copied 2026-05-14 18:19:44 -07:00
unix af_unix: Fix inq_len update problem in partial read 2026-06-03 18:52:25 -07:00
vmw_vsock vsock/vmci: fix sk_ack_backlog leak on failed handshake 2026-06-04 13:08:02 +02:00
wireless wifi: cfg80211: enforce HE/EHT cap/oper consistency 2026-06-03 13:25:19 +02:00
x25 vfs-7.1-rc1.kino 2026-04-13 12:19:01 -07:00
xdp xsk: cache csum_start/csum_offset to fix TOCTOU in xsk_skb_metadata() 2026-06-03 17:45:42 -07:00
xfrm xfrm: espintcp: do not reuse an in-progress partial send 2026-06-05 13:20:03 +02:00
compat.c socket: Unify getsockname and getpeername implementation 2025-11-26 13:45:23 -07:00
devres.c
Kconfig net: remove ax25 and amateur radio (hamradio) subsystem 2026-04-23 10:24:02 -07:00
Kconfig.debug
Makefile net: remove ax25 and amateur radio (hamradio) subsystem 2026-04-23 10:24:02 -07:00
socket.c net: guard timestamp cmsgs to real error queue skbs 2026-06-09 18:32:08 -07:00
sysctl_net.c