Thadeu Lima de Souza Cascardo b6dbfd5bcc net: fix out-of-bounds access in ops_init ... commit a26ff37e62 upstream. net_alloc_generic is called by net_alloc, which is called without any locking. It reads max_gen_ptrs, which is changed under pernet_ops_rwsem. It is read twice, first to allocate an array, then to set s.len, which is later used to limit the bounds of the array access. It is possible that the array is allocated and another thread is registering a new pernet ops, increments max_gen_ptrs, which is then used to set s.len with a larger than allocated length for the variable array. Fix it by reading max_gen_ptrs only once in net_alloc_generic. If max_gen_ptrs is later incremented, it will be caught in net_assign_generic. Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@igalia.com> Fixes: 073862ba5d ("netns: fix net_alloc_generic()") Reviewed-by: Eric Dumazet <edumazet@google.com> Reviewed-by: Kuniyuki Iwashima <kuniyu@amazon.com> Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20240502132006.3430840-1-cascardo@igalia.com Signed-off-by: Paolo Abeni <pabeni@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2024-05-17 12:02:35 +02:00
..
6lowpan	…
9p	9p: Fix read/write debug statements to report server reply	2024-04-10 16:35:57 +02:00
802	…
8021q	net: gro: fix udp bad offset in socket lookup by adding {inner_}network_offset to napi_gro_cb	2024-05-17 12:02:07 +02:00
appletalk	appletalk: Fix Use-After-Free in atalk_ioctl	2023-12-20 17:01:50 +01:00
atm	atm: Fix Use-After-Free in do_vcc_ioctl	2023-12-20 17:01:48 +01:00
ax25	ax25: Fix netdev refcount issue	2024-05-02 16:32:36 +02:00
batman-adv	batman-adv: Avoid infinite loop trying to resize local TT	2024-04-17 11:19:25 +02:00
bluetooth	Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout	2024-05-17 12:02:21 +02:00
bpf	bpf: Fix a few selftest failures due to llvm18 change	2024-02-05 20:14:20 +00:00
bpfilter	…
bridge	net-sysfs: convert dev->operstate reads to lockless ones	2024-05-17 12:02:23 +02:00
caif	…
can	can: j1939: Fix UAF in j1939_sk_match_filter during setsockopt(SO_J1939_FILTER)	2024-02-23 09:25:17 +01:00
ceph	libceph: fail sparse-read if the data length doesn't match	2024-03-01 13:34:56 +01:00
core	net: fix out-of-bounds access in ops_init	2024-05-17 12:02:35 +02:00
dcb	…
dccp	dccp/tcp: Call security_inet_conn_request() after setting IPv6 addresses.	2023-11-20 11:59:35 +01:00
devlink	devlink: fix port new reply cmd type	2024-03-26 18:20:11 -04:00
dns_resolver	keys, dns: Fix size check of V1 server-list header	2024-01-25 15:35:41 -08:00
dsa	…
ethernet	ethernet: Add helper for assigning packet type when dest address does not match device address	2024-05-02 16:32:46 +02:00
ethtool	ethtool: netlink: Add missing ethnl_ops_begin/complete	2024-01-25 15:36:00 -08:00
handshake	net/handshake: Fix handshake_req_destroy_test1	2024-02-23 09:24:50 +01:00
hsr	hsr: Simplify code for announcing HSR nodes timer setup	2024-05-17 12:02:24 +02:00
ieee802154	…
ife	net: sched: ife: fix potential use-after-free	2024-01-01 12:42:30 +00:00
ipv4	tcp: Use refcount_inc_not_zero() in tcp_twsk_unique().	2024-05-17 12:02:20 +02:00
ipv6	ipv6: prevent NULL dereference in ip6_output()	2024-05-17 12:02:24 +02:00
iucv	net/iucv: fix the allocation size of iucv_path_table array	2024-03-26 18:19:12 -04:00
kcm	net: kcm: fix incorrect parameter validation in the kcm_getsockopt) function	2024-03-26 18:19:40 -04:00
key	…
l2tp	net l2tp: drop flow hash on forward	2024-05-17 12:02:02 +02:00
l3mdev	…
lapb	…
llc	llc: call sock_orphan() at release time	2024-02-05 20:14:36 +00:00
mac80211	wifi: mac80211: fix prep_connection error path	2024-05-17 12:02:10 +02:00
mac802154	mac802154: fix llsec key resources release in mac802154_llsec_key_del	2024-04-03 15:28:27 +02:00
mctp	net: mctp: copy skb ext data when fragmenting	2024-03-26 18:19:34 -04:00
mpls	net: mpls: error out if inner headers are not set	2024-04-13 13:07:41 +02:00
mptcp	mptcp: only allow set existing scheduler for net.mptcp.scheduler	2024-05-17 12:02:30 +02:00
ncsi	net/ncsi: Fix netlink major/minor version numbers	2024-01-25 15:35:20 -08:00
netfilter	netfilter: nf_tables: honor table dormant flag from netdev release event path	2024-05-02 16:32:39 +02:00
netlabel	calipso: fix memory leak in netlbl_calipso_add_pass()	2024-01-25 15:35:14 -08:00
netlink	netlink: Fix kernel-infoleak-after-free in __skb_datagram_iter	2024-03-06 14:48:34 +00:00
netrom	netrom: Fix data-races around sysctl_net_busy_read	2024-03-15 10:48:21 -04:00
nfc	nfc: nci: Fix kcov check in nci_rx_work()	2024-05-17 12:02:22 +02:00
nsh	nsh: Restore skb->{protocol,data,mac_header} for outer header in nsh_gso_segment().	2024-05-17 12:02:02 +02:00
openvswitch	net: openvswitch: Fix Use-After-Free in ovs_ct_exit	2024-05-02 16:32:38 +02:00
packet	packet: annotate data-races around ignore_outgoing	2024-03-26 18:20:10 -04:00
phonet	phonet: fix rtm_phonet_notify() skb allocation	2024-05-17 12:02:22 +02:00
psample	psample: Require 'CAP_NET_ADMIN' when joining "packets" group	2023-12-13 18:45:10 +01:00
qrtr	net: qrtr: ns: Return 0 if server port is not present	2024-01-20 11:51:47 +01:00
rds	net/rds: fix possible cp null dereference	2024-04-10 16:35:49 +02:00
rfkill	net: rfkill: gpio: set GPIO direction	2024-01-01 12:42:41 +00:00
rose	net/rose: fix races in rose_kill_by_device()	2024-01-01 12:42:31 +00:00
rxrpc	rxrpc: Only transmit one ACK per jumbo packet received	2024-05-17 12:02:23 +02:00
sched	net/sched: fix lockdep splat in qdisc_tree_reduce_backlog()	2024-04-10 16:35:51 +02:00
sctp	sctp: fix busy polling	2024-01-25 15:35:30 -08:00
smc	net/smc: fix neighbour and rtable leak in smc_ib_find_route()	2024-05-17 12:02:24 +02:00
strparser	…
sunrpc	SUNRPC: add a missing rpc_stat for TCP TLS	2024-05-17 12:02:20 +02:00
switchdev	net: bridge: switchdev: Skip MDB replays of deferred events on offload	2024-03-01 13:35:06 +01:00
tipc	tipc: fix UAF in error path	2024-05-17 12:02:32 +02:00
tls	tls: fix lockless read of strp->msg_ready in ->poll	2024-05-02 16:32:40 +02:00
unix	af_unix: Suppress false-positive lockdep splat for spin_lock() in __unix_gc().	2024-05-02 16:32:40 +02:00
vmw_vsock	vsock/virtio: fix packet delivery to tap device	2024-04-10 16:35:50 +02:00
wireless	wifi: cfg80211: fix rdev_dump_mpp() arguments order	2024-05-17 12:02:10 +02:00
x25	net/x25: fix incorrect parameter validation in the x25_getsockopt() function	2024-03-26 18:19:41 -04:00
xdp	xsk: validate user input for XDP_{UMEM|COMPLETION}_FILL_RING	2024-04-17 11:19:28 +02:00
xfrm	xfrm: Preserve vlan tags for transport mode software GRO	2024-05-17 12:02:20 +02:00
Kconfig	…
Kconfig.debug	…
Makefile	…
compat.c	…
devres.c	…
socket.c	net: Save and restore msg_namelen in sock_sendmsg	2024-01-10 17:16:51 +01:00
sysctl_net.c	…