Sebastian Andrzej Siewior 1517be0aef hsr: Avoid double remove of a node. ... [ Upstream commit 0c74d9f79e ] Due to the hashed-MAC optimisation one problem become visible: hsr_handle_sup_frame() walks over the list of available nodes and merges two node entries into one if based on the information in the supervision both MAC addresses belong to one node. The list-walk happens on a RCU protected list and delete operation happens under a lock. If the supervision arrives on both slave interfaces at the same time then this delete operation can occur simultaneously on two CPUs. The result is the first-CPU deletes the from the list and the second CPUs BUGs while attempting to dereference a poisoned list-entry. This happens more likely with the optimisation because a new node for the mac_B entry is created once a packet has been received and removed (merged) once the supervision frame has been received. Avoid removing/ cleaning up a hsr_node twice by adding a `removed' field which is set to true after the removal and checked before the removal. Fixes: f266a683a4 ("net/hsr: Better frame dispatch") Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de> Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>		2022-12-31 13:32:22 +01:00
..
6lowpan
9p	Including fixes from bpf, can and wifi.	2022-11-29 09:52:10 -08:00
802	treewide: use prandom_u32_max() when possible, part 1	2022-10-11 17:42:55 -06:00
8021q	net: gro: skb_gro_header helper function	2022-08-25 10:33:21 +02:00
appletalk
atm	net/atm: fix proc_mpc_write incorrect return value	2022-10-15 11:08:36 +01:00
ax25	ax25: move from strlcpy with unused retval to strscpy	2022-08-22 17:55:50 -07:00
batman-adv	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2022-09-22 13:02:10 -07:00
bluetooth	Bluetooth: Fix crash when replugging CSR fake controllers	2022-12-02 13:22:56 -08:00
bpf	bpf: Move skb->len == 0 checks into __bpf_redirect	2022-12-31 13:32:14 +01:00
bpfilter
bridge	bridge: switchdev: Fix memory leaks when changing VLAN protocol	2022-11-15 13:38:11 +01:00
caif	net: caif: fix double disconnect client in chnl_net_open()	2022-11-14 10:51:13 +00:00
can	can: af_can: fix NULL pointer dereference in can_rcv_filter	2022-12-07 10:30:47 +01:00
ceph	Random number generator fixes for Linux 6.1-rc1.	2022-10-16 15:27:07 -07:00
core	bpf, sockmap: Fix missing BPF_F_INGRESS flag when using apply_bytes	2022-12-31 13:32:20 +01:00
dcb
dccp	dccp/tcp: Fixup bhash2 bucket when connect() fails.	2022-11-22 20:15:37 -08:00
dns_resolver
dsa	net: dsa: sja1105: Check return value	2022-12-02 20:46:52 -08:00
ethernet	net: gro: skb_gro_header helper function	2022-08-25 10:33:21 +02:00
ethtool	ethtool: eeprom: fix null-deref on genl_info in dump	2022-10-24 19:08:07 -07:00
hsr	hsr: Avoid double remove of a node.	2022-12-31 13:32:22 +01:00
ieee802154	net: ieee802154: fix error return code in dgram_bind()	2022-10-07 09:29:17 +02:00
ife
ipv4	bpf, sockmap: Fix data loss caused by using apply_bytes on ingress redirect	2022-12-31 13:32:20 +01:00
ipv6	net: Return errno in sk->sk_prot->get_port().	2022-12-31 13:32:13 +01:00
iucv
kcm	kcm: close race conditions on sk_receive_queue	2022-11-15 12:42:26 +01:00
key	xfrm: Fix oops in __xfrm_state_delete()	2022-11-22 07:14:55 +01:00
l2tp	l2tp: Don't sleep and disable BH under writer-side sk_callback_lock	2022-11-23 12:45:19 +00:00
l3mdev
lapb
llc
mac80211	wifi: mac80211: fix maybe-unused warning	2022-12-31 13:32:20 +01:00
mac802154	mac802154: fix missing INIT_LIST_HEAD in ieee802154_if_add()	2022-12-05 09:53:08 +01:00
mctp	mctp: Fix an error handling path in mctp_init()	2022-11-09 19:26:08 -08:00
mpls	net: Use u64_stats_fetch_begin_irq() for stats fetch.	2022-08-29 13:02:27 +01:00
mptcp	mptcp: fix sleep in atomic at close time	2022-11-28 18:03:07 -08:00
ncsi	genetlink: start to validate reserved header bytes	2022-08-29 12:47:15 +01:00
netfilter	netfilter: conntrack: set icmpv6 redirects as RELATED	2022-12-31 13:32:19 +01:00
netlabel	genetlink: start to validate reserved header bytes	2022-08-29 12:47:15 +01:00
netlink	genetlink: limit the use of validation workarounds to old ops	2022-10-27 08:20:21 -07:00
netrom
nfc	NFC: nci: Bounds check struct nfc_target arrays	2022-12-05 17:46:25 -08:00
nsh
openvswitch	netfilter: conntrack: Fix data-races around ct mark	2022-11-18 15:21:00 +01:00
packet	packet: do not set TP_STATUS_CSUM_VALID on CHECKSUM_COMPLETE	2022-11-29 08:30:18 -08:00
phonet
psample	genetlink: start to validate reserved header bytes	2022-08-29 12:47:15 +01:00
qrtr	net: qrtr: start MHI channel after endpoit creation	2022-08-15 11:21:42 +01:00
rds	treewide: use get_random_{u8,u16}() when possible, part 2	2022-10-11 17:42:58 -06:00
rfkill
rose	rose: Fix NULL pointer dereference in rose_send_frame()	2022-11-02 11:57:30 +00:00
rxrpc	rxrpc: Fix ack.bufferSize to be 0 when generating an ack	2022-12-31 13:32:09 +01:00
sched	net: sched: allow act_ct to be built without NF_NAT	2022-11-22 12:16:55 +01:00
sctp	sctp: fix memory leak in sctp_stream_outq_migrate()	2022-11-29 08:30:50 -08:00
smc	net/smc: Fix possible leaked pernet namespace in smc_init()	2022-11-02 20:42:09 -07:00
strparser
sunrpc	SUNRPC: Fix crasher in gss_unwrap_resp_integ()	2022-10-27 15:52:10 -04:00
switchdev
tipc	tipc: call tipc_lxc_xmit without holding node_read_lock	2022-12-07 11:32:04 +01:00
tls	bpf, sockmap: Fix missing BPF_F_INGRESS flag when using apply_bytes	2022-12-31 13:32:20 +01:00
unix	af_unix: Get user_ns from in_skb in unix_diag_get_exact().	2022-12-01 10:32:20 +01:00
vmw_vsock	vsock: fix possible infinite sleep in vsock_connectible_wait_data()	2022-11-03 10:49:29 +01:00
wireless	wifi: cfg80211: Fix not unregister reg_pdev when load_builtin_regdb_keys() fails	2022-12-31 13:32:20 +01:00
x25	net/x25: Fix skb leak in x25_lapb_receive_frame()	2022-11-15 20:22:19 -08:00
xdp	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2022-10-03 17:44:18 -07:00
xfrm	Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec	2022-11-23 19:18:59 -08:00
compat.c	net: clear msg_get_inq in __get_compat_msghdr()	2022-09-20 08:23:20 -07:00
devres.c
Kconfig	Remove DECnet support from kernel	2022-08-22 14:26:30 +01:00
Kconfig.debug	net: make NET_(DEV|NS)_REFCNT_TRACKER depend on NET	2022-09-20 14:23:56 -07:00
Makefile	Remove DECnet support from kernel	2022-08-22 14:26:30 +01:00
socket.c	d_path pile	2022-10-06 16:55:41 -07:00
sysctl_net.c