Kernel/linux
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2025-01-01 02:33:57 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
c31e72d021
linux/net
History
Kuniyuki Iwashima c31e72d021 tcp: Fix use-after-free of nreq in reqsk_timer_handler(). 
The cited commit replaced inet_csk_reqsk_queue_drop_and_put() with
__inet_csk_reqsk_queue_drop() and reqsk_put() in reqsk_timer_handler().

Then, oreq should be passed to reqsk_put() instead of req; otherwise
use-after-free of nreq could happen when reqsk is migrated but the
retry attempt failed (e.g. due to timeout).

Let's pass oreq to reqsk_put().

Fixes: e8c526f2bd ("tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink().")
Reported-by: Liu Jian <liujian56@huawei.com>
Closes: https://lore.kernel.org/netdev/1284490f-9525-42ee-b7b8-ccadf6606f6d@huawei.com/
Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>
Reviewed-by: Vadim Fedorenko <vadim.fedorenko@linux.dev>
Reviewed-by: Liu Jian <liujian56@huawei.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Martin KaFai Lau <martin.lau@kernel.org>
Link: https://patch.msgid.link/20241123174236.62438-1-kuniyu@amazon.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2024-11-28 09:48:00 +01:00
..
6lowpan ipv6: eliminate ndisc_ops_is_useropt() 2024-08-12 17:23:57 -07:00
9p 9p: fix slab cache name creation for real 2024-10-21 15:41:29 -07:00
802 move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
8021q net: convert to nla_get_*_default() 2024-11-11 10:32:06 -08:00
appletalk appletalk: Remove deadcode 2024-10-04 12:42:32 +01:00
atm atm: clean up a put_user() calls 2024-06-14 19:08:50 -07:00
ax25 ax25: Replace kfree() in ax25_dev_free() with ax25_dev_put() 2024-06-01 15:49:42 -07:00
batman-adv This cleanup patchset includes the following patches: 2024-10-15 15:28:17 +02:00
bluetooth Bluetooth: SCO: remove the redundant sco_conn_put 2024-11-26 11:07:28 -05:00
bpf bpf, test_run: Fix LIVE_FRAME frame update after a page has been recycled 2024-10-31 16:15:21 +01:00
bridge ndo_fdb_del: Add a parameter to report whether notification was sent 2024-11-15 16:39:18 -08:00
caif caif: Remove unused cfsrvl_getphyid 2024-10-08 15:33:49 -07:00
can can: gw: Use rtnl_register_many(). 2024-10-15 18:52:26 -07:00
ceph libceph: use min() to simplify code in ceph_dns_resolve_name() 2024-08-27 09:30:16 +02:00
core rtnetlink: fix rtnl_dump_ifinfo() error path 2024-11-24 16:43:13 -08:00
dcb dcb: Use rtnl_register_many(). 2024-10-15 18:52:26 -07:00
dccp net: fix data-races around sk->sk_forward_alloc 2024-11-11 15:29:33 -08:00
devlink net: convert to nla_get_*_default() 2024-11-11 10:32:06 -08:00
dns_resolver Networking changes for 6.8. 2024-01-11 10:07:29 -08:00
dsa net: dsa: use ethtool string helpers 2024-11-03 10:36:34 -08:00
ethernet netkit: Fix pkt_type override upon netkit pass verdict 2024-05-25 10:48:57 -07:00
ethtool Revert "net: ethtool: Avoid thousands of -Wflex-array-member-not-at-end warnings" 2024-11-18 18:52:11 -08:00
handshake remove pointless includes of <linux/fdtable.h> 2024-10-07 13:34:41 -04:00
hsr net: hsr: fix hsr_init_sk() vs network/transport headers. 2024-11-26 12:45:53 +01:00
ieee802154 net: convert to nla_get_*_default() 2024-11-11 10:32:06 -08:00
ife net: sched: ife: fix potential use-after-free 2023-12-15 10:50:18 +00:00
ipv4 tcp: Fix use-after-free of nreq in reqsk_timer_handler(). 2024-11-28 09:48:00 +01:00
ipv6 net/ipv6: delete temporary address if mngtmpaddr is removed or unmanaged 2024-11-26 10:29:12 +01:00
iucv s390/iucv: MSG_PEEK causes memory leak in iucv_sock_destruct() 2024-11-26 10:02:53 +01:00
kcm kcm: replace call_rcu by kfree_rcu for simple kmem_cache_free callback 2024-10-15 10:50:21 -07:00
key xfrm: Add support for per cpu xfrm state handling. 2024-10-29 11:56:00 +01:00
l2tp net/l2tp: fix warning in l2tp_exit_net found by syzbot 2024-11-26 09:27:07 +01:00
l3mdev
lapb
llc llc: Improve setsockopt() handling of malformed user input 2024-11-28 08:57:42 +01:00
mac80211 wireless-next patches for v6.13 2024-11-13 18:35:19 -08:00
mac802154 Including fixes from ieee802154, bluetooth and netfilter. 2024-10-03 09:44:00 -07:00
mctp net: mctp: Expose transport binding identifier via IFLA attribute 2024-11-09 09:04:54 -08:00
mpls rtnetlink: Return int from rtnl_af_register(). 2024-10-22 11:02:05 +02:00
mptcp mptcp: pm: avoid code duplication to lookup endp 2024-11-18 18:50:13 -08:00
ncsi net/ncsi: Disable the ncsi work before freeing the associated structure 2024-10-03 10:14:14 +02:00
netfilter Networking changes for 6.13. 2024-11-21 08:28:08 -08:00
netlabel Networking changes for 6.13. 2024-11-21 08:28:08 -08:00
netlink netlink: fix false positive warning in extack during dumps 2024-11-24 16:58:07 -08:00
netrom net/netrom: prefer strscpy over strcpy 2024-08-29 12:33:07 -07:00
nfc net: nfc: Propagate ISO14443 type A target ATS to userspace via netlink 2024-11-07 10:21:58 +01:00
nsh nsh: Restore skb->{protocol,data,mac_header} for outer header in nsh_gso_segment(). 2024-04-26 12:20:01 +02:00
openvswitch net: convert to nla_get_*_default() 2024-11-11 10:32:06 -08:00
packet af_packet: avoid erroring out after sock_init_data() in packet_create() 2024-10-15 18:43:07 -07:00
phonet phonet: do not call synchronize_rcu() from phonet_route_del() 2024-11-07 20:34:16 -08:00
psample net: psample: fix flag being set in wrong skb 2024-07-11 18:11:31 -07:00
qrtr net: qrtr: Update packets cloning when broadcasting 2024-09-24 10:48:16 +02:00
rds net/rds: remove unused struct 'rds_ib_dereg_odp_mr' 2024-10-03 16:42:52 -07:00
rfkill net: rfkill: gpio: Add check for clk_enable() 2024-11-12 13:30:31 +01:00
rose net: change proto and proto_ops accept type 2024-05-13 18:19:09 -06:00
rxrpc rxrpc: Improve setsockopt() handling of malformed user input 2024-11-28 08:57:42 +01:00
sched Networking changes for 6.13. 2024-11-21 08:28:08 -08:00
sctp Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2024-11-14 11:29:15 -08:00
shaper net-shapers: implement cap validation in the core 2024-10-10 08:30:23 -07:00
smc Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2024-11-07 13:44:16 -08:00
strparser
sunrpc mm: page_frag: avoid caller accessing 'page_frag_cache' directly 2024-11-11 10:56:27 -08:00
switchdev net: bridge: switchdev: Improve error message for port_obj_add/del functions 2024-05-08 12:19:12 +01:00
tipc Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2024-09-15 09:13:19 -07:00
tls move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
unix af_unix: Don't return OOB skb in manage_oob(). 2024-09-09 17:14:27 -07:00
vmw_vsock Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2024-11-14 11:29:15 -08:00
wireless wireless-next patches for v6.13 2024-11-13 18:35:19 -08:00
x25 net: change proto and proto_ops accept type 2024-05-13 18:19:09 -06:00
xdp Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2024-11-19 13:56:02 +01:00
xfrm ipsec-next-2024-11-15 2024-11-18 11:52:49 +00:00
compat.c file: stop exposing receive_fd_user() 2023-12-12 14:24:14 +01:00
devres.c
Kconfig netlink: spec: add shaper YAML spec 2024-10-10 08:30:21 -07:00
Kconfig.debug rtnetlink: Add per-netns RTNL. 2024-10-08 15:16:59 +02:00
Makefile netlink: spec: add shaper YAML spec 2024-10-10 08:30:21 -07:00
socket.c Networking changes for 6.13. 2024-11-21 08:28:08 -08:00
sysctl_net.c sysctl: Remove check for sentinel element in ctl_table arrays 2024-06-13 10:50:52 +02:00