mirrors
/
linux-stable
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
1
0
Fork 0
Code Issues Releases Wiki Activity
linux-stable/net
History
Thadeu Lima de Souza Cascardo 2d60ff5874 net: fix out-of-bounds access in ops_init 
commit a26ff37e62 upstream.

net_alloc_generic is called by net_alloc, which is called without any
locking. It reads max_gen_ptrs, which is changed under pernet_ops_rwsem. It
is read twice, first to allocate an array, then to set s.len, which is
later used to limit the bounds of the array access.

It is possible that the array is allocated and another thread is
registering a new pernet ops, increments max_gen_ptrs, which is then used
to set s.len with a larger than allocated length for the variable array.

Fix it by reading max_gen_ptrs only once in net_alloc_generic. If
max_gen_ptrs is later incremented, it will be caught in net_assign_generic.

Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@igalia.com>
Fixes: 073862ba5d ("netns: fix net_alloc_generic()")
Reviewed-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Kuniyuki Iwashima <kuniyu@amazon.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20240502132006.3430840-1-cascardo@igalia.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 		2024-05-17 11:56:21 +02:00
..
6lowpan
…
9p 9p: Fix read/write debug statements to report server reply 2024-04-10 16:28:30 +02:00
802
…
8021q vlan: skip nested type that is not IFLA_VLAN_QOS_MAPPING 2024-01-31 16:17:04 -08:00
appletalk appletalk: Fix Use-After-Free in atalk_ioctl 2023-12-20 17:00:19 +01:00
atm atm: Fix Use-After-Free in do_vcc_ioctl 2023-12-20 17:00:17 +01:00
ax25 ax25: Fix netdev refcount issue 2024-05-02 16:29:24 +02:00
batman-adv batman-adv: Avoid infinite loop trying to resize local TT 2024-04-17 11:18:22 +02:00
bluetooth Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout 2024-05-17 11:56:11 +02:00
bpf Revert "bpf, test_run: fix &xdp_frame misplacement for LIVE_FRAMES" 2023-03-17 08:50:32 +01:00
bpfilter
…
bridge net-sysfs: convert dev->operstate reads to lockless ones 2024-05-17 11:56:13 +02:00
caif net: caif: Fix use-after-free in cfusbl_device_notify() 2023-03-17 08:50:24 +01:00
can can: j1939: Fix UAF in j1939_sk_match_filter during setsockopt(SO_J1939_FILTER) 2024-02-23 09:12:47 +01:00
ceph libceph: use kernel_connect() 2023-10-19 23:08:56 +02:00
core net: fix out-of-bounds access in ops_init 2024-05-17 11:56:21 +02:00
dcb net: dcb: choose correct policy to parse DCB_ATTR_BCN 2023-08-11 12:08:17 +02:00
dccp dccp/tcp: Call security_inet_conn_request() after setting IPv6 addresses. 2023-11-20 11:52:16 +01:00
devlink devlink: remove reload failed checks in params get/set callbacks 2023-09-23 11:11:01 +02:00
dns_resolver keys, dns: Fix size check of V1 server-list header 2024-01-25 15:27:38 -08:00
dsa net: dsa: introduce preferred_default_local_cpu_port and use on MT7530 2024-04-27 17:07:17 +02:00
ethernet ethernet: Add helper for assigning packet type when dest address does not match device address 2024-05-02 16:29:29 +02:00
ethtool ethtool: netlink: Add missing ethnl_ops_begin/complete 2024-01-25 15:27:51 -08:00
hsr hsr: Simplify code for announcing HSR nodes timer setup 2024-05-17 11:56:13 +02:00
ieee802154
…
ife net: sched: ife: fix potential use-after-free 2024-01-01 12:38:56 +00:00
ipv4 tcp: Use refcount_inc_not_zero() in tcp_twsk_unique(). 2024-05-17 11:56:11 +02:00
ipv6 ipv6: prevent NULL dereference in ip6_output() 2024-05-17 11:56:13 +02:00
iucv net/iucv: fix the allocation size of iucv_path_table array 2024-03-26 18:20:25 -04:00
kcm net: kcm: fix incorrect parameter validation in the kcm_getsockopt) function 2024-03-26 18:20:42 -04:00
key net: af_key: fix sadb_x_filter validation 2023-08-23 17:52:32 +02:00
l2tp net l2tp: drop flow hash on forward 2024-05-17 11:55:59 +02:00
l3mdev
…
lapb
…
llc llc: call sock_orphan() at release time 2024-02-05 20:13:01 +00:00
mac80211 wifi: mac80211: fix ieee80211_bss_*_flags kernel-doc 2024-05-17 11:56:04 +02:00
mac802154 mac802154: fix llsec key resources release in mac802154_llsec_key_del 2024-04-03 15:19:31 +02:00
mctp net: mctp: copy skb ext data when fragmenting 2024-03-26 18:20:37 -04:00
mpls net: mpls: error out if inner headers are not set 2024-04-13 13:05:27 +02:00
mptcp mptcp: ensure snd_nxt is properly initialized on connect 2024-05-17 11:56:19 +02:00
ncsi net/ncsi: Fix netlink major/minor version numbers 2024-01-25 15:27:24 -08:00
netfilter netfilter: nf_tables: honor table dormant flag from netdev release event path 2024-05-02 16:29:26 +02:00
netlabel calipso: fix memory leak in netlbl_calipso_add_pass() 2024-01-25 15:27:20 -08:00
netlink netlink: Fix kernel-infoleak-after-free in __skb_datagram_iter 2024-03-06 14:45:06 +00:00
netrom netrom: Fix data-races around sysctl_net_busy_read 2024-03-15 10:48:18 -04:00
nfc nfc: nci: Fix uninit-value in nci_dev_up and nci_ntf_packet 2024-04-10 16:28:21 +02:00
nsh nsh: Restore skb->{protocol,data,mac_header} for outer header in nsh_gso_segment(). 2024-05-17 11:55:59 +02:00
openvswitch net: openvswitch: Fix Use-After-Free in ovs_ct_exit 2024-05-02 16:29:25 +02:00
packet packet: annotate data-races around ignore_outgoing 2024-03-26 18:20:59 -04:00
phonet phonet: fix rtm_phonet_notify() skb allocation 2024-05-17 11:56:12 +02:00
psample psample: Require 'CAP_NET_ADMIN' when joining "packets" group 2023-12-13 18:39:11 +01:00
qrtr net: qrtr: ns: Return 0 if server port is not present 2024-01-20 11:50:09 +01:00
rds net/rds: fix possible cp null dereference 2024-04-10 16:28:25 +02:00
rfkill net: rfkill: gpio: set GPIO direction 2024-01-01 12:39:04 +00:00
rose net/rose: fix races in rose_kill_by_device() 2024-01-01 12:38:57 +00:00
rxrpc rxrpc: Fix response to PING RESPONSE ACKs to a dead call 2024-02-16 19:06:27 +01:00
sched net/sched: fix lockdep splat in qdisc_tree_reduce_backlog() 2024-04-10 16:28:26 +02:00
sctp sctp: fix busy polling 2024-01-25 15:27:30 -08:00
smc net/smc: fix neighbour and rtable leak in smc_ib_find_route() 2024-05-17 11:56:13 +02:00
strparser
…
sunrpc timers: Get rid of del_singleshot_timer_sync() 2024-05-17 11:56:12 +02:00
switchdev net: bridge: switchdev: Skip MDB replays of deferred events on offload 2024-03-01 13:26:35 +01:00
tipc tipc: fix UAF in error path 2024-05-17 11:56:20 +02:00
tls tls: get psock ref after taking rxlock to avoid leak 2024-04-10 16:28:22 +02:00
unix af_unix: Suppress false-positive lockdep splat for spin_lock() in __unix_gc(). 2024-05-02 16:29:27 +02:00
vmw_vsock vsock/virtio: fix packet delivery to tap device 2024-04-10 16:28:25 +02:00
wireless wifi: cfg80211: fix rdev_dump_mpp() arguments order 2024-05-17 11:56:04 +02:00
x25 net/x25: fix incorrect parameter validation in the x25_getsockopt() function 2024-03-26 18:20:42 -04:00
xdp xsk: validate user input for XDP_{UMEM|COMPLETION}_FILL_RING 2024-04-17 11:18:23 +02:00
xfrm xfrm: Preserve vlan tags for transport mode software GRO 2024-05-17 11:56:10 +02:00
Kconfig
…
Kconfig.debug
…
Makefile devlink: move code to a dedicated directory 2023-08-30 16:11:00 +02:00
compat.c
…
devres.c
…
socket.c splice, net: Add a splice_eof op to file-ops and socket-ops 2024-01-10 17:10:27 +01:00
sysctl_net.c
…