Eric Dumazet 2d5ff7e339 ipv6: prevent possible UAF in ip6_xmit() ...

If skb_expand_head() returns NULL, skb has been freed
and the associated dst/idev could also have been freed.

We must use rcu_read_lock() to prevent a possible UAF.

Fixes: 0c9f227bee11 ("ipv6: use skb_expand_head in ip6_xmit")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Vasily Averin <vasily.averin@linux.dev>
Reviewed-by: David Ahern <dsahern@kernel.org>
Link: https://patch.msgid.link/20240820160859.3786976-4-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

2024-08-21 17:35:49 -07:00

..

ila

ila: block BH in ila_output()

2024-06-03 18:50:09 -07:00

netfilter

netfilter: allow ipv6 fragments to arrive on different devices

2024-08-14 21:16:12 +02:00

addrconf_core.c

ipv6: Ensure natural alignment of const ipv6 loopback and router addresses

2024-01-30 12:43:18 +01:00

addrconf.c

sysctl: treewide: constify the ctl_table argument of proc_handlers

2024-07-24 20:59:29 +02:00

addrlabel.c

ipv6: remove RTNL protection from ip6addrlbl_dump()

2024-04-08 11:01:05 +01:00

af_inet6.c

ipsec-next-2024-07-13

2024-07-14 07:56:32 -07:00

ah6.c

net: fill in MODULE_DESCRIPTION()s for ipv6 modules

2024-02-09 14:12:01 -08:00

anycast.c

ipv6: anycast: use call_rcu_hurry() in aca_put()

2024-05-01 11:46:21 +01:00

calipso.c

netlabel: remove impossible return value in netlbl_bitmap_walk

2024-02-28 19:37:34 -08:00

datagram.c

ipv6: annotate data-races around np->ucast_oif

2023-12-11 10:59:17 +00:00

esp6_offload.c

xfrm: Log input direction mismatch error in one place

2024-06-17 13:53:19 +02:00

esp6.c

net: esp: cleanup esp_output_tail_tcp() in case of unsupported ESPINTCP

2024-05-23 08:46:03 +02:00

exthdrs_core.c

ipv6: Fix out-of-bounds access in ipv6_find_tlv()

2023-05-24 08:43:39 +01:00

exthdrs_offload.c

net: gso: add HBH extension header offload support

2024-01-05 08:11:49 -08:00

exthdrs.c

net: ipv6: exthdrs: get rid of ipv6_skb_net()

2024-03-11 15:15:08 -07:00

fib6_notifier.c

net: fib_notifier: propagate extack down to the notifier block callback

2019-10-04 11:10:56 -07:00

fib6_rules.c

ipv6: fib6_rules: avoid possible NULL dereference in fib6_rule_action()

2024-05-08 18:50:53 -07:00

fou6.c

net: Add MODULE_DESCRIPTION entries to network modules

2020-06-20 21:33:57 -07:00

icmp.c

net: ipv{6,4}: Remove the now superfluous sentinel elements from ctl_table array

2024-05-03 13:29:42 +01:00

inet6_connection_sock.c

net: implement lockless SO_PRIORITY

2023-10-01 19:09:54 +01:00

inet6_hashtables.c

tcp: get rid of twsk_unique()

2024-05-09 20:25:55 -07:00

ioam6_iptunnel.c

ipv6: ioam: block BH from ioam6_output()

2024-06-03 18:50:08 -07:00

ioam6.c

ipv6/addrconf: annotate data-races around devconf fields (II)

2024-03-01 08:42:33 +00:00

ip6_checksum.c

net: udp: fix handling of CHECKSUM_COMPLETE packets

2018-10-24 14:18:16 -07:00

ip6_fib.c

Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

2024-06-20 13:49:59 -07:00

ip6_flowlabel.c

ipv6: move np->repflow to atomic flags

2023-09-15 10:33:48 +01:00

ip6_gre.c

net: ip6_gre: Remove generic .ndo_get_stats64

2024-04-15 11:32:13 +01:00

ip6_icmp.c

net: icmp: pass zeroed opts from icmp{,v6}_ndo_send before sending

2021-02-23 11:29:52 -08:00

ip6_input.c

ipv6/addrconf: annotate data-races around devconf fields (II)

2024-03-01 08:42:33 +00:00

ip6_offload.c

net: gro: initialize network_offset in network layer

2024-05-27 16:46:59 -07:00

ip6_offload.h

treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152

2019-05-30 11:26:32 -07:00

ip6_output.c

ipv6: prevent possible UAF in ip6_xmit()

2024-08-21 17:35:49 -07:00

ip6_tunnel.c

ip6_tunnel: Fix broken GRO

2024-08-20 13:21:10 +02:00

ip6_udp_tunnel.c

net: fill in MODULE_DESCRIPTION()s for ipv6 modules

2024-02-09 14:12:01 -08:00

ip6_vti.c

net: annotate writes on dev->mtu from ndo_change_mtu()

2024-05-07 16:19:14 -07:00

ip6mr.c

ipv6: introduce dst_rt6_info() helper

2024-04-29 13:32:01 +01:00

ipcomp6.c

xfrm: ipcomp: add extack to ipcomp{4,6}_init_state

2022-09-29 07:18:00 +02:00

ipv6_sockglue.c

net: use unrcu_pointer() helper

2024-06-06 11:52:52 +02:00

Kconfig

ipv6: fix indentation of a config attribute

2023-08-16 10:03:08 +01:00

Makefile

net/tcp: Introduce TCP_AO setsockopt()s

2023-10-27 10:35:44 +01:00

mcast_snoop.c

net: bridge: mcast: fix broken length + header check for MRDv6 Adv.

2021-04-27 14:02:06 -07:00

mcast.c

ipv6/addrconf: annotate data-races around devconf fields (II)

2024-03-01 08:42:33 +00:00

mip6.c

net: fill in MODULE_DESCRIPTION()s for ipv6 modules

2024-02-09 14:12:01 -08:00

ndisc.c

ipv6: fix ndisc_is_useropt() handling for PIO

2024-08-01 11:40:29 +02:00

netfilter.c

Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

2024-06-13 13:13:46 -07:00

output_core.c

ipv6: annotate data-races around cnf.hop_limit

2024-03-01 08:42:31 +00:00

ping.c

ipv6: introduce dst_rt6_info() helper

2024-04-29 13:32:01 +01:00

proc.c

minmax: add a few more MIN_T/MAX_T users

2024-07-28 13:41:14 -07:00

protocol.c

treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152

2019-05-30 11:26:32 -07:00

raw.c

net: raw: use sk_skb_reason_drop to free rx packets

2024-06-19 12:44:22 +01:00

reassembly.c

net: Rename mono_delivery_time to tstamp_type for scalabilty

2024-05-23 14:14:23 -07:00

route.c

sysctl: treewide: constify the ctl_table argument of proc_handlers

2024-07-24 20:59:29 +02:00

rpl_iptunnel.c

net: ipv6: rpl_iptunnel: block BH in rpl_output() and rpl_input()

2024-06-03 18:50:08 -07:00

rpl.c

ipv6: rpl: Remove pskb(_may)?_pull() in ipv6_rpl_srh_rcv().

2023-06-19 11:32:58 -07:00

seg6_hmac.c

ipv6: sr: fix memleak in seg6_hmac_init_algo

2024-05-21 13:16:25 +02:00

seg6_iptunnel.c

ipv6: sr: block BH in seg6_output_core() and seg6_input_core()

2024-06-03 18:50:08 -07:00

seg6_local.c

seg6: Use nested-BH locking for seg6_bpf_srh_states.

2024-06-24 16:41:23 -07:00

seg6.c

ipv6: sr: restruct ifdefines

2024-05-30 18:29:38 -07:00

sit.c

ip_tunnel: convert __be16 tunnel flags to bitmaps

2024-04-01 10:49:28 +01:00

syncookies.c

tcp: use sk_skb_reason_drop to free rx packets

2024-06-19 12:44:22 +01:00

sysctl_net_ipv6.c

sysctl: treewide: constify the ctl_table argument of proc_handlers

2024-07-24 20:59:29 +02:00

tcp_ao.c

net/tcp: Wire up l3index to TCP-AO

2023-10-27 10:35:46 +01:00

tcp_ipv6.c

tcp: use sk_skb_reason_drop to free rx packets

2024-06-19 12:44:22 +01:00

tcpv6_offload.c

net: gro: use cb instead of skb->network_header

2024-05-13 14:44:06 -07:00

tunnel6.c

net: fill in MODULE_DESCRIPTION()s for ipv6 modules

2024-02-09 14:12:01 -08:00

udp_impl.h

tcp/udp: Call inet6_destroy_sock() in IPv6 sk->sk_destruct().

2022-10-12 17:50:37 -07:00

udp_offload.c

net: gro: fix udp bad offset in socket lookup by adding {inner_}network_offset to napi_gro_cb

2024-05-02 11:02:48 +02:00

udp.c

udp: Remove duplicate included header file trace/events/udp.h

2024-07-09 13:30:25 +02:00

udplite.c

udplite: remove UDPLITE_BIT

2023-09-14 16:16:36 +02:00

xfrm6_input.c

Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

2024-05-09 10:01:01 -07:00

xfrm6_output.c

ipv6: drop feature RTAX_FEATURE_ALLFRAG

2023-10-25 18:04:29 -07:00

xfrm6_policy.c

ipsec-next-2024-07-13

2024-07-14 07:56:32 -07:00

xfrm6_protocol.c

xfrm: add support for UDPv6 encapsulation of ESP

2020-04-28 11:28:36 +02:00

xfrm6_state.c

xfrm: remove output_finish indirection from xfrm_state_afinfo

2020-05-06 09:40:08 +02:00

xfrm6_tunnel.c

ipsec-next-2024-03-06

2024-03-08 10:56:05 +00:00