linux-stable/net
Ido Schimmel 8a2618e14f ipv4: Fix incorrect table ID in IOCTL path
Commit f96a3d7455 ("ipv4: Fix incorrect route flushing when source
address is deleted") started to take the table ID field in the FIB info
structure into account when determining if two structures are identical
or not. This field is initialized using the 'fc_table' field in the
route configuration structure, which is not set when adding a route via
IOCTL.

The above can result in user space being able to install two identical
routes that only differ in the table ID field of their associated FIB
info.

Fix by initializing the table ID field in the route configuration
structure in the IOCTL path.

Before the fix:

 # ip route add default via 192.0.2.2
 # route add default gw 192.0.2.2
 # ip -4 r show default
 # default via 192.0.2.2 dev dummy10
 # default via 192.0.2.2 dev dummy10

After the fix:

 # ip route add default via 192.0.2.2
 # route add default gw 192.0.2.2
 SIOCADDRT: File exists
 # ip -4 r show default
 default via 192.0.2.2 dev dummy10

Audited the code paths to ensure there are no other paths that do not
properly initialize the route configuration structure when installing a
route.

Fixes: 5a56a0b3a4 ("net: Don't delete routes in different VRFs")
Fixes: f96a3d7455 ("ipv4: Fix incorrect route flushing when source address is deleted")
Reported-by: gaoxingwang <gaoxingwang1@huawei.com>
Link: https://lore.kernel.org/netdev/20230314144159.2354729-1-gaoxingwang1@huawei.com/
Tested-by: gaoxingwang <gaoxingwang1@huawei.com>
Signed-off-by: Ido Schimmel <idosch@nvidia.com>
Reviewed-by: David Ahern <dsahern@kernel.org>
Link: https://lore.kernel.org/r/20230315124009.4015212-1-idosch@nvidia.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2023-03-16 17:26:31 -07:00
..
6lowpan
9p 9p patches for 6.3 merge window (part 1) 2023-03-01 08:52:49 -08:00
802 treewide: Convert del_timer*() to timer_shutdown*() 2022-12-25 13:38:09 -08:00
8021q
appletalk
atm driver core: make struct class.dev_uevent() take a const * 2022-11-24 17:12:15 +01:00
ax25 ax25: af_ax25: Remove unnecessary (void*) conversions 2022-11-16 13:31:03 +00:00
batman-adv batman-adv: tvlv: prepare for tvlv enabled multicast packet type 2023-01-21 19:01:59 +01:00
bluetooth TTY/Serial driver updates for 6.3-rc1 2023-02-24 12:17:14 -08:00
bpf bpf, test_run: fix &xdp_frame misplacement for LIVE_FRAMES 2023-03-06 11:15:54 -08:00
bpfilter
bridge Merge git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf 2023-02-22 21:25:23 -08:00
caif net: caif: Fix use-after-free in cfusbl_device_notify() 2023-03-02 22:22:07 -08:00
can Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2023-02-09 12:25:40 -08:00
ceph Networking changes for 6.3. 2023-02-21 18:24:12 -08:00
core xdp: add xdp_set_features_flag utility routine 2023-03-10 21:33:47 -08:00
dcb net: dcb: add helper functions to retrieve PCP and DSCP rewrite maps 2023-01-20 09:33:22 +00:00
dccp dccp/tcp: Avoid negative sk_forward_alloc by ipv6_pinfo.pktoptions. 2023-02-10 19:53:42 -08:00
devlink devlink: drop leftover duplicate/unused code 2023-02-20 11:38:35 +00:00
dns_resolver
dsa net: dsa: don't error out when drivers return ETH_DATA_LEN in .port_max_mtu() 2023-03-16 17:39:42 +00:00
ethernet net: ethernet: use sysfs_emit() to instead of scnprintf() 2022-12-07 20:02:44 -08:00
ethtool net: ethtool: fix __ethtool_dev_mm_supported() implementation 2023-02-21 09:05:01 -08:00
hsr net: hsr: Don't log netdev_err message on unknown prp dst node 2023-03-14 15:26:10 +00:00
ieee802154 ieee802154: Prevent user from crashing the host 2023-03-02 14:39:48 +01:00
ife
ipv4 ipv4: Fix incorrect table ID in IOCTL path 2023-03-16 17:26:31 -07:00
ipv6 net: tunnels: annotate lockless accesses to dev->needed_headroom 2023-03-15 00:04:04 -07:00
iucv
kcm net/sock: Introduce trace_sk_data_ready() 2023-01-23 11:26:50 +00:00
key af_key: Fix heap information leak 2023-02-13 09:30:14 +00:00
l2tp l2tp: Avoid possible recursive deadlock in l2tp_tunnel_register() 2023-02-20 09:25:20 +00:00
l3mdev
lapb
llc
mac80211 wifi: mac80211: check basic rates validity 2023-03-10 11:47:00 +01:00
mac802154 Merge tag 'ieee802154-for-net-next-2023-02-20' of git://git.kernel.org/pub/scm/linux/kernel/git/sschmidt/wpan-next 2023-02-20 16:40:52 -08:00
mctp net: mctp: purge receive queues on sk destruction 2023-01-28 00:26:09 -08:00
mpls net: mpls: fix stale pointer if allocation fails during device rename 2023-02-15 10:26:37 +00:00
mptcp mptcp: fix lockdep false positive in mptcp_pm_nl_create_listen_socket() 2023-03-10 21:42:56 -08:00
ncsi net: Use of_property_read_bool() for boolean properties 2023-03-16 17:41:28 +00:00
netfilter netfilter: nft_redir: correct value of inet type .maxattrs 2023-03-08 12:26:42 +01:00
netlabel
netlink genetlink: Use string_is_terminated() helper 2023-02-09 22:30:24 -08:00
netrom netrom: Fix use-after-free caused by accept on already connected socket 2023-01-30 07:30:47 +00:00
nfc nfc: change order inside nfc_se_io error path 2023-03-07 13:37:05 -08:00
nsh
openvswitch There is no particular theme here - mainly quick hits all over the tree. 2023-02-23 17:55:40 -08:00
packet net: no longer support SOCK_REFCNT_DEBUG feature 2023-02-15 10:25:21 +00:00
phonet net/sock: Introduce trace_sk_data_ready() 2023-01-23 11:26:50 +00:00
psample
qrtr Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2023-02-02 14:49:55 -08:00
rds rds: rds_rm_zerocopy_callback() correct order for list_add_tail() 2023-02-13 09:33:39 +00:00
rfkill rfkill: Use sysfs_emit() to instead of sprintf() 2023-02-14 12:21:14 +01:00
rose net/rose: Fix to not accept on connected socket 2023-01-28 00:19:57 -08:00
rxrpc Networking changes for 6.3. 2023-02-21 18:24:12 -08:00
sched net/sched: flower: fix fl_change() error recovery path 2023-03-01 08:49:54 +00:00
sctp sctp: add a refcnt in sctp_stream_priorities to avoid a nested loop 2023-02-23 12:59:40 -08:00
smc net/smc: Fix device de-init sequence 2023-03-15 08:15:19 +00:00
strparser
sunrpc nfsd-6.3 fixes: 2023-03-01 11:03:44 -08:00
switchdev
tipc Networking changes for 6.3. 2023-02-21 18:24:12 -08:00
tls net: tls: fix device-offloaded sendpage straddling records 2023-03-06 13:26:16 -08:00
unix af_unix: fix struct pid leaks in OOB support 2023-03-08 23:26:03 -08:00
vmw_vsock virtio/vsock: don't drop skbuff on copy failure 2023-03-16 17:28:23 +00:00
wireless wifi: cfg80211: fix MLO connection ownership 2023-03-10 11:47:25 +01:00
x25 net/x25: Fix to not accept on connected socket 2023-01-25 09:51:04 +00:00
xdp xsk: add linux/vmalloc.h to xsk.c 2023-02-21 09:00:09 -08:00
xfrm ipsec-2023-03-15 2023-03-16 17:23:48 -07:00
compat.c use less confusing names for iov_iter direction initializers 2022-11-25 13:01:55 -05:00
devres.c
Kconfig
Kconfig.debug
Makefile devlink: move code to a dedicated directory 2023-01-05 22:12:00 -08:00
socket.c net: avoid double iput when sock_alloc_file fails 2023-03-08 23:26:51 -08:00
sysctl_net.c