shinys000114/linux
1
0
Fork 0
mirror of https://github.com/hardkernel/linux.git synced 2026-03-26 12:30:23 +09:00
Code Issues Packages Projects Releases Wiki Activity
Files
d58cdad855dec37dfeedea53bb6e27cf14c89664
linux/net
History
M A Ramdhan f686a35a77 UPSTREAM: net/sched: cls_fw: Fix improper refcount update leads to use-after-free 
[ Upstream commit 0323bce598 ]

In the event of a failure in tcf_change_indev(), fw_set_parms() will
immediately return an error after incrementing or decrementing
reference counter in tcf_bind_filter().  If attacker can control
reference counter to zero and make reference freed, leading to
use after free.

In order to prevent this, move the point of possible failure above the
point where the TC_FW_CLASSID is handled.

Bug: 292252062
Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Reported-by: M A Ramdhan <ramdhan@starlabs.sg>
Signed-off-by: M A Ramdhan <ramdhan@starlabs.sg>
Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
Reviewed-by: Pedro Tammela <pctammela@mojatatu.com>
Message-ID: <20230705161530.52003-1-ramdhan@starlabs.sg>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
(cherry picked from commit c91fb29bb0)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: I9bf6f540b4eb23ea5641fb3efe6f3e621d7b6151
2023-07-25 13:14:41 +00:00
..
6lowpan
6lowpan: iphc: Fix an off-by-one check of array index
2021-07-22 16:19:03 +02:00
9p
Merge 5.15.108 into android14-5.15
2023-04-25 16:02:54 +00:00
802
mrp: introduce active flags to prevent UAF when applicant uninit
2022-12-31 13:14:42 +01:00
8021q
net: use eth_hw_addr_set() instead of ether_addr_copy()
2022-08-31 17:16:37 +02:00
appletalk
net: socket: rework compat_ifreq_ioctl()
2021-07-23 14:20:25 +01:00
atm
UPSTREAM: net: SO_RCVMARK socket option for SO_MARK with recvmsg()
2023-06-08 00:00:33 +00:00
ax25
net: ax25: Fix deadlock caused by skb_recv_datagram in ax25_recvmsg
2022-06-22 14:22:01 +02:00
batman-adv
batman-adv: Use netif_rx_any_context() any.
2022-07-29 17:25:07 +02:00
bluetooth
UPSTREAM: net: SO_RCVMARK socket option for SO_MARK with recvmsg()
2023-06-08 00:00:33 +00:00
bpf
bpf: Move skb->len == 0 checks into __bpf_redirect
2022-12-31 13:14:11 +01:00
bpfilter
ANDROID: GKI: set vfs-only exports into their own namespace
2022-04-07 15:14:24 +02:00
bridge
netfilter: br_netfilter: fix recent physdev match breakage
2023-04-26 13:51:47 +02:00
caif
net: caif: Fix use-after-free in cfusbl_device_notify()
2023-03-17 08:48:54 +01:00
can
UPSTREAM: net: SO_RCVMARK socket option for SO_MARK with recvmsg()
2023-06-08 00:00:33 +00:00
ceph
libceph: fix potential use-after-free on linger ping and resends
2022-05-25 09:57:28 +02:00
core
BACKPORT: revert "net: align SO_RCVMARK required privileges with SO_MARK"
2023-07-03 19:15:32 +00:00
dcb
net: dcb: disable softirqs in dcbnl_flush_dev()
2022-03-08 19:12:52 +01:00
dccp
dccp: Call inet6_destroy_sock() via sk->sk_destruct().
2023-04-26 13:51:54 +02:00
decnet
net: Fix data-races around sysctl_[rw]mem(_offset)?.
2022-08-03 12:03:51 +02:00
dns_resolver
net: remove redundant 'depends on NET'
2021-01-27 17:04:12 -08:00
dsa
net: dsa: tag_brcm: legacy: fix daisy-chained switches
2023-03-30 12:47:48 +02:00
ethernet
move netdev_boot_setup into Space.c
2021-08-03 13:05:26 +01:00
ethtool
ethtool: reset #lanes when lanes is omitted
2023-04-13 16:48:20 +02:00
hsr
hsr: ratelimit only when errors are printed
2023-04-05 11:25:02 +02:00
ieee802154
UPSTREAM: net: SO_RCVMARK socket option for SO_MARK with recvmsg()
2023-06-08 00:00:33 +00:00
ife
net: remove redundant 'depends on NET'
2021-01-27 17:04:12 -08:00
ipv4
UPSTREAM: tcp: deny tcp_disconnect() when threads are waiting
2023-06-15 13:37:57 +00:00
ipv6
UPSTREAM: net: SO_RCVMARK socket option for SO_MARK with recvmsg()
2023-06-08 00:00:33 +00:00
iucv
net/iucv: Fix size of interrupt data
2023-03-22 13:31:28 +01:00
kcm
kcm: close race conditions on sk_receive_queue
2022-11-26 09:24:50 +01:00
key
UPSTREAM: net: SO_RCVMARK socket option for SO_MARK with recvmsg()
2023-06-08 00:00:33 +00:00
l2tp
inet6: Remove inet6_destroy_sock() in sk->sk_prot->destroy().
2023-04-26 13:51:54 +02:00
l3mdev
l3mdev: l3mdev_master_upper_ifindex_by_index_rcu should be using netdev_master_upper_dev_get_rcu
2022-04-27 14:38:53 +02:00
lapb
net: lapb: Use list_for_each_entry() to simplify code in lapb_iface.c
2021-06-08 16:31:25 -07:00
llc
llc: only change llc->dev when bind() succeeds
2022-03-28 09:58:46 +02:00
mac80211
Merge 5.15.107 into android14-5.15
2023-04-17 11:31:12 +00:00
mac802154
mac802154: fix missing INIT_LIST_HEAD in ieee802154_if_add()
2022-12-14 11:37:25 +01:00
mctp
UPSTREAM: net: SO_RCVMARK socket option for SO_MARK with recvmsg()
2023-06-08 00:00:33 +00:00
mpls
net: mpls: fix stale pointer if allocation fails during device rename
2023-02-22 12:57:09 +01:00
mptcp
inet6: Remove inet6_destroy_sock() in sk->sk_prot->destroy().
2023-04-26 13:51:54 +02:00
ncsi
net/ncsi: check for error return from call to nla_put_u32
2022-01-05 12:42:37 +01:00
netfilter
UPSTREAM: netfilter: nf_tables: fix chain binding transaction logic
2023-07-25 12:26:59 +01:00
netlabel
netlabel: fix out-of-bounds memory accesses
2022-04-13 20:59:10 +02:00
netlink
netlink: annotate data races around sk_state
2023-02-01 08:27:27 +01:00
netrom
netrom: Fix use-after-free caused by accept on already connected socket
2023-02-09 11:26:36 +01:00
nfc
nfc: change order inside nfc_se_io error path
2023-03-17 08:48:49 +01:00
nsh
…
openvswitch
net: openvswitch: fix possible memory leak in ovs_meter_cmd_set()
2023-02-22 12:57:09 +01:00
packet
UPSTREAM: net: SO_RCVMARK socket option for SO_MARK with recvmsg()
2023-06-08 00:00:33 +00:00
phonet
phonet: refcount leak in pep_sock_accep
2022-01-11 15:35:16 +01:00
psample
psample: Add additional metadata attributes
2021-03-14 15:00:43 -07:00
qrtr
net: qrtr: Fix an uninit variable access bug in qrtr_tx_resume()
2023-04-20 12:13:53 +02:00
rds
rds: rds_rm_zerocopy_callback() correct order for list_add_tail()
2023-03-10 09:39:16 +01:00
rfkill
rfkill: make new event layout opt-in
2022-04-08 14:23:00 +02:00
rose
net/rose: Fix to not accept on connected socket
2023-02-22 12:57:02 +01:00
rxrpc
rxrpc: Fix missing unlock in rxrpc_do_sendmsg()
2022-12-31 13:14:39 +01:00
sched
UPSTREAM: net/sched: cls_fw: Fix improper refcount update leads to use-after-free
2023-07-25 13:14:41 +00:00
sctp
UPSTREAM: net: SO_RCVMARK socket option for SO_MARK with recvmsg()
2023-06-08 00:00:33 +00:00
smc
net/smc: fix deadlock triggered by cancel_delayed_work_syn()
2023-03-22 13:31:26 +01:00
strparser
bpf: sockmap, strparser, and tls are reusing qdisc_skb_cb and colliding
2021-11-18 19:17:11 +01:00
sunrpc
Merge 5.15.107 into android14-5.15
2023-04-17 11:31:12 +00:00
switchdev
net: make switchdev_bridge_port_{,unoffload} loosely coupled with the bridge
2021-08-04 12:35:07 +01:00
tipc
UPSTREAM: tipc: check the bearer min mtu properly when setting it by netlink
2023-06-14 12:35:34 +00:00
tls
net: tls: fix possible race condition between do_tls_getsockopt_conf() and do_tls_setsockopt_conf()
2023-03-30 12:47:43 +02:00
unix
Merge 5.15.103 into android14-5.15
2023-03-23 12:10:59 +00:00
vmw_vsock
Merge 5.15.86 into android14-5.15
2023-01-18 12:52:16 +00:00
wireless
UPSTREAM: wifi: cfg80211: fix link del callback to call correct handler
2023-07-03 19:15:28 +00:00
x25
net/x25: Fix to not accept on connected socket
2023-02-09 11:26:40 +01:00
xdp
xsk: Add missing overflow check in xdp_umem_reg
2023-03-30 12:47:44 +02:00
xfrm
FROMGIT: xfrm: Check if_id in inbound policy/secpath match
2023-05-12 20:04:23 +00:00
compat.c
net: Return the correct errno code
2021-06-03 15:13:56 -07:00
devres.c
net: devres: Correct a grammatical error
2021-06-11 12:55:28 -07:00
Kconfig
mctp: Add MCTP base
2021-07-29 15:06:49 +01:00
Makefile
mctp: Add MCTP base
2021-07-29 15:06:49 +01:00
socket.c
UPSTREAM: net: use a bounce buffer for copying skb->mark
2023-07-03 15:04:00 +01:00
sysctl_net.c
net: Ensure net namespace isolation of sysctls
2021-04-12 13:27:11 -07:00
TEST_MAPPING
ANDROID: align include/net, net/ TEST_MAPPING config with platform
2021-09-15 18:14:38 +00:00