shinys000114/linux
1
0
Fork 0
mirror of https://github.com/hardkernel/linux.git synced 2026-03-25 03:50:24 +09:00
Code Issues Packages Projects Releases Wiki Activity
Files
af4fc583fd9005a61c6d2c16bf95d64fd29897fd
linux/net
History
Kuniyuki Iwashima 13159c7125 tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). 
commit c65f27b9c3be2269918e1cbad6d8884741f835c5 upstream.

get_netdev_for_sock() is called during setsockopt(),
so not under RCU.

Using sk_dst_get(sk)->dev could trigger UAF.

Let's use __sk_dst_get() and dst_dev_rcu().

Note that the only ->ndo_sk_get_lower_dev() user is
bond_sk_get_lower_dev(), which uses RCU.

Fixes: e8f6979981 ("net/tls: Add generic NIC offload infrastructure")
Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Sabrina Dubroca <sd@queasysnail.net>
Link: https://patch.msgid.link/20250916214758.650211-6-kuniyu@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
[ Keerthana: Backport to v6.6.y ]
Signed-off-by: Keerthana K <keerthana.kalyanasundaram@broadcom.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-01-17 16:29:55 +01:00
..
6lowpan
6lowpan: Remove redundant initialisation.
2023-03-29 08:22:52 +01:00
9p
net/9p: fix double req put in p9_fd_cancelled
2025-10-12 12:56:23 +02:00
802
net: 802: LLC+SNAP OID:PID lookup on start of skb data
2025-01-17 13:36:11 +01:00
8021q
net: vlan: sync VLAN features with lower device
2025-11-24 10:29:52 +01:00
appletalk
net: appletalk: Fix use-after-free in AARP proxy probe
2025-08-01 09:47:29 +01:00
atm
net: atm: fix memory leak in atm_register_sysfs when device_register fail
2025-09-09 18:56:25 +02:00
ax25
ax25: properly unshare skbs in ax25_kiss_rcv()
2025-09-09 18:56:25 +02:00
batman-adv
batman-adv: fix OOB read/write in network-coding decode
2025-09-09 18:56:27 +02:00
bluetooth
tty: introduce and use tty_port_tty_vhangup() helper
2026-01-11 15:22:25 +01:00
bpf
bpf, test_run: Fix use-after-free issue in eth_skb_pkt_type()
2025-02-27 04:10:50 -08:00
bpfilter
net: Use umd_cleanup_helper()
2023-05-31 13:06:57 +02:00
bridge
net: Remove RTNL dance for SIOCBRADDIF and SIOCBRDELIF.
2026-01-11 15:22:25 +01:00
caif
caif: fix integer underflow in cffrml_receive()
2026-01-11 15:21:46 +01:00
can
can: j1939: j1939_local_ecu_get(): undo increment when j1939_local_ecu_get() fails
2025-09-19 16:32:06 +02:00
ceph
libceph: make calc_target() set t->paused, not just clear it
2026-01-17 16:29:54 +01:00
core
net: Allow to use SMP threads for backlog NAPI.
2026-01-11 15:22:30 +01:00
dcb
net: dcb: choose correct policy to parse DCB_ATTR_BCN
2023-08-01 21:07:46 -07:00
dccp
net: fix data-races around sk->sk_forward_alloc
2025-01-23 17:21:19 +01:00
devlink
devlink: rate: Unset parent pointer in devl_rate_nodes_destroy
2025-12-01 11:41:48 +01:00
dns_resolver
keys, dns: Fix size check of V1 server-list header
2024-01-25 15:35:41 -08:00
dsa
net: dsa: improve shutdown sequence
2025-11-24 10:30:05 +01:00
ethernet
ethernet: Extend device_get_mac_address() to use NVMEM
2025-11-24 10:29:39 +01:00
ethtool
ethtool: Avoid overflowing userspace buffer on stats query
2026-01-11 15:21:47 +01:00
handshake
net/handshake: restore destructor on submit failure
2026-01-11 15:22:02 +01:00
hsr
net/hsr: fix NULL pointer dereference in prp_get_untagged_frame()
2026-01-11 15:21:50 +01:00
ieee802154
net: Rename mono_delivery_time to tstamp_type for scalabilty
2025-05-09 09:43:57 +02:00
ife
net: sched: ife: fix potential use-after-free
2024-01-01 12:42:30 +00:00
ipv4
net: Add locking to protect skb->dev access in ip_output
2026-01-17 16:29:54 +01:00
ipv6
ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr()
2026-01-11 15:22:08 +01:00
iucv
s390/iucv: MSG_PEEK causes memory leak in iucv_sock_destruct()
2024-12-09 10:32:33 +01:00
kcm
kcm: Serialise kcm_sendmsg() for the same socket.
2024-08-29 17:33:46 +02:00
key
Revert "xfrm: destroy xfrm_state synchronously on net exit path"
2026-01-11 15:21:06 +01:00
l2tp
ipv6: introduce dst_rt6_info() helper
2024-12-14 19:59:35 +01:00
l3mdev
l3mdev: l3mdev_master_upper_ifindex_by_index_rcu should be using netdev_master_upper_dev_get_rcu
2022-04-15 14:27:24 -07:00
lapb
…
llc
llc: fix data loss when reading from a socket in llc_ui_recvmsg()
2025-06-04 14:42:20 +02:00
mac80211
wifi: mac80211: Discard Beacon frames to non-broadcast address
2026-01-11 15:22:23 +01:00
mac802154
mac802154: check local interfaces before deleting sdata list
2025-01-23 17:21:13 +01:00
mctp
mctp: return -ENOPROTOOPT for unknown getsockopt options
2025-09-09 18:56:24 +02:00
mpls
mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu().
2025-06-27 11:09:02 +01:00
mptcp
mptcp: ensure context reset on disconnect()
2026-01-11 15:22:24 +01:00
ncsi
net: ncsi: Fix buffer overflow in fetching version id
2025-08-28 16:28:24 +02:00
netfilter
netfilter: nf_tables: remove redundant chain validation on register store
2026-01-11 15:21:46 +01:00
netlabel
calipso: unlock rcu before returning -EAFNOSUPPORT
2025-06-19 15:28:46 +02:00
netlink
netlink: add variable-length / auto integers
2025-09-09 18:56:22 +02:00
netrom
netrom: Fix memory leak in nr_sendmsg()
2026-01-11 15:21:45 +01:00
nfc
net: nfc: fix deadlock between nfc_unregister_device and rfkill_fop_write
2026-01-11 15:22:18 +01:00
nsh
nsh: Restore skb->{protocol,data,mac_header} for outer header in nsh_gso_segment().
2024-05-17 12:02:02 +02:00
openvswitch
net: openvswitch: Avoid needlessly taking the RTNL on vport destroy
2026-01-11 15:22:06 +01:00
packet
net/packet: fix a race in packet_set_ring() and packet_notifier()
2025-08-15 12:09:05 +02:00
phonet
phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept()
2025-07-24 08:53:12 +02:00
psample
psample: Require 'CAP_NET_ADMIN' when joining "packets" group
2023-12-13 18:45:10 +01:00
qrtr
net: qrtr: Update packets cloning when broadcasting
2024-10-04 16:29:41 +02:00
rds
rds: Fix endianness annotation for RDS_MPATH_HASH
2025-11-24 10:29:29 +01:00
rfkill
net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer
2025-09-25 11:00:08 +02:00
rose
net: rose: fix invalid array index in rose_kill_by_device()
2026-01-11 15:22:08 +01:00
rxrpc
rxrpc: Fix transmission of an abort in response to an abort
2025-07-24 08:53:20 +02:00
sched
net/sched: ets: Remove drr class from the active list if it changes to strict
2026-01-11 15:21:46 +01:00
sctp
sctp: Defer SCTP_DBG_OBJCNT_DEC() to sctp_destroy_sock().
2026-01-11 15:21:16 +01:00
smc
net/smc: fix mismatch between CLC header and proposal
2025-11-24 10:29:59 +01:00
strparser
strparser: Fix signed/unsigned mismatch bug
2025-11-24 10:30:07 +01:00
sunrpc
svcrdma: bound check rq_pages index in inline path
2026-01-11 15:22:23 +01:00
switchdev
net: switchdev: Convert blocking notification chain to a raw one
2025-03-22 12:50:39 -07:00
tipc
tipc: Fix use-after-free in tipc_mon_reinit_self().
2025-11-24 10:29:59 +01:00
tls
tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock().
2026-01-17 16:29:55 +01:00
unix
af_unix: Initialise scc_index in unix_add_edge().
2025-11-24 10:29:59 +01:00
vmw_vsock
vsock: Ignore signal/timeout on connect() if already established
2025-12-01 11:41:49 +01:00
wireless
wifi: avoid kernel-infoleak from struct iw_point
2026-01-17 16:29:53 +01:00
x25
net/x25: fix incorrect parameter validation in the x25_getsockopt() function
2024-03-26 18:19:41 -04:00
xdp
xsk: fix an integer overflow in xp_create_and_assign_umem()
2025-03-28 21:59:55 +01:00
xfrm
xfrm: state: fix out-of-bounds read during lookup
2026-01-11 15:22:26 +01:00
compat.c
net/compat: Update msg_control_is_user when setting a kernel pointer
2023-04-14 11:09:27 +01:00
devres.c
…
Kconfig
bpf: Add fd-based tcx multi-prog infra with link support
2023-07-19 10:07:27 -07:00
Kconfig.debug
net: make NET_(DEV|NS)_REFCNT_TRACKER depend on NET
2022-09-20 14:23:56 -07:00
Makefile
af_unix: Remove CONFIG_UNIX_SCM.
2025-06-04 14:42:22 +02:00
socket.c
net: Remove RTNL dance for SIOCBRADDIF and SIOCBRDELIF.
2026-01-11 15:22:25 +01:00
sysctl_net.c
sysctl: treewide: drop unused argument ctl_table_root::set_ownership(table)
2024-08-11 12:47:13 +02:00