Antoine Tenart 2eeab8c47c gro: fix ownership transfer ... commit ed4cccef64 upstream. If packets are GROed with fraglist they might be segmented later on and continue their journey in the stack. In skb_segment_list those skbs can be reused as-is. This is an issue as their destructor was removed in skb_gro_receive_list but not the reference to their socket, and then they can't be orphaned. Fix this by also removing the reference to the socket. For example this could be observed, kernel BUG at include/linux/skbuff.h:3131! (skb_orphan) RIP: 0010:ip6_rcv_core+0x11bc/0x19a0 Call Trace: ipv6_list_rcv+0x250/0x3f0 __netif_receive_skb_list_core+0x49d/0x8f0 netif_receive_skb_list_internal+0x634/0xd40 napi_complete_done+0x1d2/0x7d0 gro_cell_poll+0x118/0x1f0 A similar construction is found in skb_gro_receive, apply the same change there. Fixes: 5e10da5385 ("skbuff: allow 'slow_gro' for skb carring sock reference") Signed-off-by: Antoine Tenart <atenart@kernel.org> Reviewed-by: Willem de Bruijn <willemb@google.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2024-04-10 16:28:26 +02:00
..
6lowpan
9p	net: 9p: avoid freeing uninit memory in p9pdu_vreadf	2024-01-01 12:39:04 +00:00
802
8021q	vlan: skip nested type that is not IFLA_VLAN_QOS_MAPPING	2024-01-31 16:17:04 -08:00
appletalk	appletalk: Fix Use-After-Free in atalk_ioctl	2023-12-20 17:00:19 +01:00
atm	atm: Fix Use-After-Free in do_vcc_ioctl	2023-12-20 17:00:17 +01:00
ax25
batman-adv	net: vlan: introduce skb_vlan_eth_hdr()	2023-12-20 17:00:16 +01:00
bluetooth	Bluetooth: Fix TOCTOU in HCI debugfs implementation	2024-04-10 16:28:24 +02:00
bpf
bpfilter
bridge	netfilter: validate user input for expected length	2024-04-10 16:28:25 +02:00
caif
can	can: j1939: Fix UAF in j1939_sk_match_filter during setsockopt(SO_J1939_FILTER)	2024-02-23 09:12:47 +01:00
ceph	libceph: use kernel_connect()	2023-10-19 23:08:56 +02:00
core	gro: fix ownership transfer	2024-04-10 16:28:26 +02:00
dcb	net: dcb: choose correct policy to parse DCB_ATTR_BCN	2023-08-11 12:08:17 +02:00
dccp	dccp/tcp: Call security_inet_conn_request() after setting IPv6 addresses.	2023-11-20 11:52:16 +01:00
devlink	devlink: remove reload failed checks in params get/set callbacks	2023-09-23 11:11:01 +02:00
dns_resolver	keys, dns: Fix size check of V1 server-list header	2024-01-25 15:27:38 -08:00
dsa	net: dsa: sja1105: always enable the send_meta options	2023-07-19 16:22:06 +02:00
ethernet
ethtool	ethtool: netlink: Add missing ethnl_ops_begin/complete	2024-01-25 15:27:51 -08:00
hsr	hsr: Handle failures in module init	2024-03-26 18:21:00 -04:00
ieee802154
ife	net: sched: ife: fix potential use-after-free	2024-01-01 12:38:56 +00:00
ipv4	gro: fix ownership transfer	2024-04-10 16:28:26 +02:00
ipv6	netfilter: validate user input for expected length	2024-04-10 16:28:25 +02:00
iucv	net/iucv: fix the allocation size of iucv_path_table array	2024-03-26 18:20:25 -04:00
kcm	net: kcm: fix incorrect parameter validation in the kcm_getsockopt) function	2024-03-26 18:20:42 -04:00
key	net: af_key: fix sadb_x_filter validation	2023-08-23 17:52:32 +02:00
l2tp	l2tp: fix incorrect parameter validation in the pppol2tp_getsockopt() function	2024-03-26 18:20:42 -04:00
l3mdev
lapb
llc	llc: call sock_orphan() at release time	2024-02-05 20:13:01 +00:00
mac80211	wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes	2024-04-03 15:19:48 +02:00
mac802154	mac802154: fix llsec key resources release in mac802154_llsec_key_del	2024-04-03 15:19:31 +02:00
mctp	net: mctp: copy skb ext data when fragmenting	2024-03-26 18:20:37 -04:00
mpls
mptcp	mptcp: fix possible deadlock in subflow diag	2024-03-06 14:45:12 +00:00
ncsi	net/ncsi: Fix netlink major/minor version numbers	2024-01-25 15:27:24 -08:00
netfilter	netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get()	2024-04-10 16:28:25 +02:00
netlabel	calipso: fix memory leak in netlbl_calipso_add_pass()	2024-01-25 15:27:20 -08:00
netlink	netlink: Fix kernel-infoleak-after-free in __skb_datagram_iter	2024-03-06 14:45:06 +00:00
netrom	netrom: Fix data-races around sysctl_net_busy_read	2024-03-15 10:48:18 -04:00
nfc	nfc: nci: Fix uninit-value in nci_dev_up and nci_ntf_packet	2024-04-10 16:28:21 +02:00
nsh
openvswitch	net: openvswitch: limit the number of recursions from action sets	2024-02-23 09:12:30 +01:00
packet	packet: annotate data-races around ignore_outgoing	2024-03-26 18:20:59 -04:00
phonet	phonet/pep: fix racy skb_queue_empty() use	2024-03-01 13:26:38 +01:00
psample	psample: Require 'CAP_NET_ADMIN' when joining "packets" group	2023-12-13 18:39:11 +01:00
qrtr	net: qrtr: ns: Return 0 if server port is not present	2024-01-20 11:50:09 +01:00
rds	net/rds: fix possible cp null dereference	2024-04-10 16:28:25 +02:00
rfkill	net: rfkill: gpio: set GPIO direction	2024-01-01 12:39:04 +00:00
rose	net/rose: fix races in rose_kill_by_device()	2024-01-01 12:38:57 +00:00
rxrpc	rxrpc: Fix response to PING RESPONSE ACKs to a dead call	2024-02-16 19:06:27 +01:00
sched	net/sched: fix lockdep splat in qdisc_tree_reduce_backlog()	2024-04-10 16:28:26 +02:00
sctp	sctp: fix busy polling	2024-01-25 15:27:30 -08:00
smc	net/smc: disable SEID on non-s390 archs where virtual ISM may be used	2024-02-05 20:12:54 +00:00
strparser
sunrpc	net: sunrpc: Fix an off by one in rpc_sockaddr2uaddr()	2024-03-26 18:20:55 -04:00
switchdev	net: bridge: switchdev: Skip MDB replays of deferred events on offload	2024-03-01 13:26:35 +01:00
tipc	tipc: Check the bearer type before calling tipc_udp_nl_bearer_add()	2024-02-16 19:06:27 +01:00
tls	tls: get psock ref after taking rxlock to avoid leak	2024-04-10 16:28:22 +02:00
unix	af_unix: Annotate data-race of gc_in_progress in wait_for_unix_gc().	2024-03-26 18:20:31 -04:00
vmw_vsock	vsock/virtio: fix packet delivery to tap device	2024-04-10 16:28:25 +02:00
wireless	wifi: nl80211: reject iftype change with mesh ID change	2024-03-06 14:45:10 +00:00
x25	net/x25: fix incorrect parameter validation in the x25_getsockopt() function	2024-03-26 18:20:42 -04:00
xdp	xsk: Skip polling event check for unbound socket	2023-12-13 18:39:08 +01:00
xfrm	xfrm: Avoid clang fortify warning in copy_to_user_tmpl()	2024-04-03 15:19:40 +02:00
compat.c
devres.c
Kconfig
Kconfig.debug
Makefile	devlink: move code to a dedicated directory	2023-08-30 16:11:00 +02:00
socket.c	splice, net: Add a splice_eof op to file-ops and socket-ops	2024-01-10 17:10:27 +01:00
sysctl_net.c