linux-stable/net
Zhengchao Shao 7dfe23659f ip_vti: fix potential slab-use-after-free in decode_session6
[ Upstream commit 6018a26627 ]

When ip_vti device is set to the qdisc of the sfb type, the cb field
of the sent skb may be modified during enqueuing. Then,
slab-use-after-free may occur when ip_vti device sends IPv6 packets.
As commit f855691975 ("xfrm6: Fix the nexthdr offset in
_decode_session6.") showed, xfrm_decode_session was originally intended
only for the receive path. IP6CB(skb)->nhoff is not set during
transmission. Therefore, set the cb field in the skb to 0 before
sending packets.

Fixes: f855691975 ("xfrm6: Fix the nexthdr offset in _decode_session6.")
Signed-off-by: Zhengchao Shao <shaozhengchao@huawei.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-08-30 16:31:48 +02:00
..
6lowpan
9p 9p/xen : Fix use after free bug in xen_9pfs_front_remove due to race condition 2023-04-20 12:04:40 +02:00
802 mrp: introduce active flags to prevent UAF when applicant uninit 2023-01-18 11:30:36 +01:00
8021q vlan: fix a potential uninit-value in vlan_dev_hard_start_xmit() 2023-05-30 12:42:11 +01:00
appletalk appletalk: Fix skb allocation size in loopback case 2021-04-07 12:48:49 +02:00
atm atm: hide unused procfs functions 2023-06-09 10:24:01 +02:00
ax25 ax25: Fix UAF bugs in ax25 timers 2022-04-27 13:39:46 +02:00
batman-adv batman-adv: Broken sync while rescheduling delayed work 2023-06-14 10:57:13 +02:00
bluetooth Bluetooth: L2CAP: Fix use-after-free 2023-08-30 16:31:43 +02:00
bpf bpf, test_run: Fix alignment problem in bpf_prog_test_run_skb() 2022-11-25 17:40:29 +01:00
bpfilter
bridge net: bridge: keep ports without IFF_UNICAST_FLT in BR_PROMISC mode 2023-08-11 11:45:14 +02:00
caif net: caif: Fix use-after-free in cfusbl_device_notify() 2023-03-17 08:31:44 +01:00
can can: bcm: Fix UAF in bcm_proc_show() 2023-08-11 11:45:24 +02:00
ceph libceph: fix potential hang in ceph_osdc_notify() 2023-08-11 11:45:38 +02:00
core net: add missing data-race annotation for sk_ll_usec 2023-08-11 11:45:37 +02:00
dcb net: dcb: disable softirqs in dcbnl_flush_dev() 2022-03-08 19:04:10 +01:00
dccp dccp: fix data-race around dp->dccps_mss_cache 2023-08-16 18:13:00 +02:00
decnet Remove DECnet support from kernel 2023-06-21 15:39:57 +02:00
dns_resolver
dsa net: dsa: Add missing of_node_put() in dsa_port_parse_of 2022-03-23 09:10:44 +01:00
ethernet
hsr net: hsr: Fix potential use-after-free 2022-12-08 11:18:33 +01:00
ieee802154 net: ieee802154: fix error return code in dgram_bind() 2022-11-03 23:52:30 +09:00
ife
ipv4 ip_vti: fix potential slab-use-after-free in decode_session6 2023-08-30 16:31:48 +02:00
ipv6 ip6_vti: fix slab-use-after-free in decode_session6 2023-08-30 16:31:48 +02:00
iucv net/iucv: Fix size of interrupt data 2023-03-22 13:27:10 +01:00
kcm kcm: close race conditions on sk_receive_queue 2022-11-25 17:40:29 +01:00
key net: af_key: fix sadb_x_filter validation 2023-08-30 16:31:48 +02:00
l2tp inet6: Remove inet6_destroy_sock() in sk->sk_prot->destroy(). 2023-04-26 11:21:53 +02:00
l3mdev
lapb net: lapb: Copy the skb before sending a packet 2021-02-10 09:21:06 +01:00
llc llc: Don't drop packet from non-root netns. 2023-08-11 11:45:26 +02:00
mac80211 wifi: mac80211: fix invalid drv_sta_pre_rcu_remove calls for non-uploaded sta 2023-04-20 12:04:38 +02:00
mac802154 mac802154: fix missing INIT_LIST_HEAD in ieee802154_if_add() 2022-12-14 11:28:28 +01:00
mpls net: mpls: fix stale pointer if allocation fails during device rename 2023-02-22 12:47:21 +01:00
ncsi net/ncsi: Avoid channel_monitor hrtimer deadlock 2021-04-14 08:22:35 +02:00
netfilter netfilter: nf_tables: report use refcount overflow 2023-08-16 18:13:01 +02:00
netlabel net: fix NULL pointer reference in cipso_v4_doi_free 2021-09-22 11:48:09 +02:00
netlink netlink: Add __sock_i_ino() for __netlink_diag_dump(). 2023-08-11 11:45:07 +02:00
netrom netrom: fix info-leak in nr_write_internal() 2023-06-09 10:23:55 +02:00
nfc nfc: llcp: fix possible use of uninitialized variable in nfc_llcp_send_connect() 2023-08-11 11:45:04 +02:00
nsh net: nsh: Use correct mac_offset to unwind gso skb in nsh_gso_segment() 2023-05-30 12:42:11 +01:00
openvswitch net: openvswitch: fix flow memory leak in ovs_flow_cmd_new 2023-02-22 12:47:12 +01:00
packet net/packet: annotate data-races around tp->status 2023-08-16 18:13:00 +02:00
phonet phonet: refcount leak in pep_sock_accep 2022-01-11 13:58:50 +01:00
psample
qrtr net: qrtr: fix another OOB Read in qrtr_endpoint_post 2021-09-03 09:58:00 +02:00
rds rds: rds_rm_zerocopy_callback() correct order for list_add_tail() 2023-03-11 16:31:37 +01:00
rfkill
rose net/rose: Fix to not accept on connected socket 2023-02-22 12:47:19 +01:00
rxrpc rxrpc: Fix hard call timeout units 2023-05-17 11:13:24 +02:00
sched sch_netem: fix issues in netem_change() vs get_dist_table() 2023-08-16 18:13:01 +02:00
sctp sctp: fix potential deadlock on &net->sctp.addr_wq_lock 2023-08-11 11:45:13 +02:00
smc net/smc: Remove redundant refcount increase 2022-09-15 12:17:03 +02:00
strparser
sunrpc SUNRPC: Fix UAF in svc_tcp_listen_data_ready() 2023-08-11 11:45:20 +02:00
switchdev
tipc net: tipc: resize nlattr array to correct size 2023-06-21 15:39:59 +02:00
tls net/tls: Fix race in TLS device down flow 2022-07-29 17:10:32 +02:00
unix net: add missing data-race annotations around sk->sk_peek_off 2023-08-11 11:45:37 +02:00
vmw_vsock vsock: avoid to close connected socket after the timeout 2023-05-30 12:42:10 +01:00
wimax
wireless wifi: wext-core: Fix -Wstringop-overflow warning in ioctl_standard_iw_point() 2023-08-11 11:45:25 +02:00
x25 net/x25: Fix to not accept on connected socket 2023-02-22 12:47:12 +01:00
xdp xsk: Simplify detection of empty and full rings 2021-05-22 10:59:48 +02:00
xfrm xfrm: fix slab-use-after-free in decode_session6 2023-08-30 16:31:48 +02:00
compat.c net: Return the correct errno code 2021-06-30 08:48:13 -04:00
Kconfig Remove DECnet support from kernel 2023-06-21 15:39:57 +02:00
Makefile Remove DECnet support from kernel 2023-06-21 15:39:57 +02:00
socket.c net: annotate sk->sk_err write from do_recvmmsg() 2023-05-30 12:42:07 +01:00
sysctl_net.c