github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-05-13 00:28:54 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity
v7.0
linux/net/ipv6
History
Justin Iurman b30b1675aa net: ioam6: fix OOB and missing lock 
When trace->type.bit6 is set:

    if (trace->type.bit6) {
        ...
        queue = skb_get_tx_queue(dev, skb);
        qdisc = rcu_dereference(queue->qdisc);

This code can lead to an out-of-bounds access of the dev->_tx[] array
when is_input is true. In such a case, the packet is on the RX path and
skb->queue_mapping contains the RX queue index of the ingress device. If
the ingress device has more RX queues than the egress device (dev) has
TX queues, skb_get_queue_mapping(skb) will exceed dev->num_tx_queues.
Add a check to avoid this situation since skb_get_tx_queue() does not
clamp the index. This issue has also revealed that per queue visibility
cannot be accurate and will be replaced later as a new feature.

While at it, add missing lock around qdisc_qstats_qlen_backlog(). The
function __ioam6_fill_trace_data() is called from both softirq and
process contexts, hence the use of spin_lock_bh() here.

Fixes: b63c5478e9 ("ipv6: ioam: Support for Queue depth data field")
Reported-by: Jakub Kicinski <kuba@kernel.org>
Closes: https://lore.kernel.org/netdev/20260403214418.2233266-2-kuba@kernel.org/
Signed-off-by: Justin Iurman <justin.iurman@gmail.com>
Link: https://patch.msgid.link/20260404134137.24553-1-justin.iurman@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-04-08 19:08:56 -07:00
..
ila Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
netfilter netfilter: ip6t_eui64: reject invalid MAC header for all packets 2026-04-08 13:33:56 +02:00
addrconf_core.c ipv6: Ensure natural alignment of const ipv6 loopback and router addresses 2024-01-30 12:43:18 +01:00
addrconf.c ipv6: prevent possible UaF in addrconf_permanent_addr() 2026-03-30 17:25:10 -07:00
addrlabel.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
af_inet6.c ipv6: move the disable_ipv6_mod knob to core code 2026-03-11 17:53:37 -07:00
ah6.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
anycast.c treewide: Replace kmalloc with kmalloc_obj for non-scalar types 2026-02-21 01:02:28 -08:00
calipso.c Convert remaining multi-line kmalloc_obj/flex GFP_KERNEL uses 2026-02-22 08:26:33 -08:00
datagram.c ipv6: avoid overflows in ip6_datagram_send_ctl() 2026-04-02 08:25:22 -07:00
esp6_offload.c xfrm: Fix inner mode lookup in tunnel mode GSO segmentation 2025-12-04 09:54:53 +01:00
esp6.c esp: fix skb leak with espintcp and async crypto 2026-02-25 09:11:40 +01:00
exthdrs_core.c
exthdrs_offload.c net: gso: add HBH extension header offload support 2024-01-05 08:11:49 -08:00
exthdrs.c ipv6: add NULL checks for idev in SRv6 paths 2026-03-18 17:23:43 -07:00
fib6_notifier.c net: do not acquire rtnl in fib_seq_sum() 2024-10-11 15:35:05 -07:00
fib6_rules.c ipv6: fib_rules: Add DSCP mask matching 2025-02-21 16:08:48 -08:00
fou6.c
icmp.c ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() 2026-03-27 20:22:46 -07:00
inet6_connection_sock.c tcp: inet6_csk_xmit() optimization 2026-02-10 20:57:50 -08:00
inet6_hashtables.c inet: annotate data-races around isk->inet_num 2026-02-27 17:16:59 -08:00
ioam6_iptunnel.c ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() 2026-02-13 12:24:05 -08:00
ioam6.c net: ioam6: fix OOB and missing lock 2026-04-08 19:08:56 -07:00
ip6_checksum.c
ip6_fib.c ipv6: fix data race in fib6_metric_set() using cmpxchg 2026-04-01 17:44:35 -07:00
ip6_flowlabel.c net: ipv6: flowlabel: defer exclusive option free until RCU teardown 2026-03-31 15:44:29 -07:00
ip6_gre.c ipv6: use dst6_mtu() instead of dst_mtu() 2026-02-02 17:49:29 -08:00
ip6_icmp.c icmp: fix icmp_ndo_send address translation for reply direction 2025-09-01 12:54:41 -07:00
ip6_input.c net/ipv6: Introduce payload_len helpers 2026-02-06 20:50:03 -08:00
ip6_offload.c net/ipv6: Remove jumbo_remove step from TX path 2026-02-06 20:50:12 -08:00
ip6_offload.h
ip6_output.c treewide: Replace kmalloc with kmalloc_obj for non-scalar types 2026-02-21 01:02:28 -08:00
ip6_tunnel.c ip6_tunnel: clear skb2->cb[] in ip4ip6_err() 2026-03-27 20:24:12 -07:00
ip6_udp_tunnel.c net: Convert proto_ops connect() callbacks to use sockaddr_unsized 2025-11-04 19:10:32 -08:00
ip6_vti.c ipv6: adopt skb_dst_dev() and skb_dst_dev_net[_rcu]() helpers 2025-07-02 14:32:30 -07:00
ip6mr.c ipv6: ip6_mc_input() and ip6_mr_input() cleanups 2025-07-02 14:32:30 -07:00
ipcomp6.c xfrm: delete x->tunnel as we delete x 2025-07-08 13:28:27 +02:00
ipv6_sockglue.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
Kconfig ipv6: sr: Use HMAC-SHA1 and HMAC-SHA256 library functions 2025-08-26 18:11:29 -07:00
Makefile gro: inline tcp6_gro_receive() 2026-01-21 19:28:32 -08:00
mcast_snoop.c
mcast.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
mip6.c net: fill in MODULE_DESCRIPTION()s for ipv6 modules 2024-02-09 14:12:01 -08:00
ndisc.c net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak 2026-03-26 20:38:35 -07:00
netfilter.c netfilter: Switch to skb_dstref_steal to clear dst_entry 2025-08-19 17:54:19 -07:00
output_core.c net/ipv6: Introduce payload_len helpers 2026-02-06 20:50:03 -08:00
ping.c net: Convert proto callbacks from sockaddr to sockaddr_unsized 2025-11-04 19:10:33 -08:00
proc.c ipv6: snmp: do not track per idev ICMP6_MIB_RATELIMITHOST 2025-09-08 18:06:20 -07:00
protocol.c
raw.c ipv6: do not use skb_header_pointer() in icmpv6_filter() 2026-02-06 20:34:20 -08:00
reassembly.c ipv6: adopt skb_dst_dev() and skb_dst_dev_net[_rcu]() helpers 2025-07-02 14:32:30 -07:00
route.c ipv6: Don't remove permanent routes with exceptions from tb6_gc_hlist. 2026-03-23 16:59:31 -07:00
rpl_iptunnel.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2025-07-17 11:00:33 -07:00
rpl.c
seg6_hmac.c ipv6: add NULL checks for idev in SRv6 paths 2026-03-18 17:23:43 -07:00
seg6_iptunnel.c seg6: separate dst_cache for input and output paths in seg6 lwtunnel 2026-04-07 20:20:56 -07:00
seg6_local.c ipv6: adopt dst_dev() helper 2025-07-02 14:32:30 -07:00
seg6.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
sit.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
syncookies.c tcp: secure_seq: add back ports to TS offset 2026-03-04 17:44:35 -08:00
sysctl_net_ipv6.c sysctl: treewide: constify the ctl_table argument of proc_handlers 2024-07-24 20:59:29 +02:00
tcp_ao.c net/tcp: Wire up l3index to TCP-AO 2023-10-27 10:35:46 +01:00
tcp_ipv6.c tcp: secure_seq: add back ports to TS offset 2026-03-04 17:44:35 -08:00
tcpv6_offload.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2026-01-29 17:28:54 -08:00
tunnel6.c net: fill in MODULE_DESCRIPTION()s for ipv6 modules 2024-02-09 14:12:01 -08:00
udp_impl.h udp: move udp_memory_allocated into net_aligned_data 2025-07-02 14:22:02 -07:00
udp_offload.c gro: inline tcp6_gro_complete() 2026-01-21 19:28:32 -08:00
udp.c udp: udplite is unlikely 2026-01-06 17:06:03 -08:00
udplite.c udplite: Fix null-ptr-deref in __udp_enqueue_schedule_skb(). 2026-02-20 16:14:10 -08:00
xfrm6_input.c xfrm: hold dev ref until after transport_finish NF_HOOK 2026-04-07 10:12:40 +02:00
xfrm6_output.c ipv6: adopt skb_dst_dev() and skb_dst_dev_net[_rcu]() helpers 2025-07-02 14:32:30 -07:00
xfrm6_policy.c xfrm6: fix uninitialized saddr in xfrm6_get_saddr() 2026-02-02 08:03:47 +01:00
xfrm6_protocol.c
xfrm6_state.c
xfrm6_tunnel.c xfrm: flush all states in xfrm_state_fini 2025-08-06 09:23:38 +02:00