mirrors/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2024-09-18 00:24:39 +00:00
Code Issues Releases Wiki Activity
linux-stable/net
History
Xin Long a7b42969d6 tipc: add an extra conn_get in tipc_conn_alloc 
One extra conn_get() is needed in tipc_conn_alloc(), as after
tipc_conn_alloc() is called, tipc_conn_close() may free this
con before deferencing it in tipc_topsrv_accept():

   tipc_conn_alloc();
   newsk = newsock->sk;
                                 <---- tipc_conn_close();
   write_lock_bh(&sk->sk_callback_lock);
   newsk->sk_data_ready = tipc_conn_data_ready;

Then an uaf issue can be triggered:

  BUG: KASAN: use-after-free in tipc_topsrv_accept+0x1e7/0x370 [tipc]
  Call Trace:
   <TASK>
   dump_stack_lvl+0x33/0x46
   print_report+0x178/0x4b0
   kasan_report+0x8c/0x100
   kasan_check_range+0x179/0x1e0
   tipc_topsrv_accept+0x1e7/0x370 [tipc]
   process_one_work+0x6a3/0x1030
   worker_thread+0x8a/0xdf0

This patch fixes it by holding it in tipc_conn_alloc(), then after
all accessing in tipc_topsrv_accept() releasing it. Note when does
this in tipc_topsrv_kern_subscr(), as tipc_conn_rcv_sub() returns
0 or -1 only, we don't need to check for "> 0".

Fixes: c5fa7b3cf3 ("tipc: introduce new TIPC server infrastructure")
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Acked-by: Jon Maloy <jmaloy@redhat.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2022-11-21 20:45:24 -08:00
..
6lowpan net: 6lowpan: constify lowpan_nhc structures 2022-06-09 21:53:28 +02:00
9p net/9p: clarify trans_fd parse_opt failure handling 2022-10-07 21:23:09 +09:00
802 treewide: use prandom_u32_max() when possible, part 1 2022-10-11 17:42:55 -06:00
8021q net: gro: skb_gro_header helper function 2022-08-25 10:33:21 +02:00
appletalk
atm net/atm: fix proc_mpc_write incorrect return value 2022-10-15 11:08:36 +01:00
ax25 ax25: move from strlcpy with unused retval to strscpy 2022-08-22 17:55:50 -07:00
batman-adv Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2022-09-22 13:02:10 -07:00
bluetooth Bluetooth: L2CAP: Fix attempting to access uninitialized memory 2022-11-02 16:37:00 -07:00
bpf bpf, test_run: Fix alignment problem in bpf_prog_test_run_skb() 2022-11-04 16:22:34 +01:00
bpfilter
bridge bridge: switchdev: Fix memory leaks when changing VLAN protocol 2022-11-15 13:38:11 +01:00
caif net: caif: fix double disconnect client in chnl_net_open() 2022-11-14 10:51:13 +00:00
can can: j1939: j1939_send_one(): fix missing CAN header initialization 2022-11-07 14:00:27 +01:00
ceph Random number generator fixes for Linux 6.1-rc1. 2022-10-16 15:27:07 -07:00
core netfilter: conntrack: Fix data-races around ct mark 2022-11-18 15:21:00 +01:00
dcb
dccp treewide: use get_random_{u8,u16}() when possible, part 1 2022-10-11 17:42:58 -06:00
dns_resolver
dsa net: dsa: don't leak tagger-owned storage on switch driver unbind 2022-11-15 20:50:52 -08:00
ethernet net: gro: skb_gro_header helper function 2022-08-25 10:33:21 +02:00
ethtool ethtool: eeprom: fix null-deref on genl_info in dump 2022-10-24 19:08:07 -07:00
hsr net: hsr: avoid possible NULL deref in skb_clone() 2022-10-18 19:18:27 -07:00
ieee802154 net: ieee802154: fix error return code in dgram_bind() 2022-10-07 09:29:17 +02:00
ife
ipv4 ipv4/fib: Replace zero-length array with DECLARE_FLEX_ARRAY() helper 2022-11-21 13:03:36 +00:00
ipv6 ipv6: addrlabel: fix infoleak when sending struct ifaddrlblmsg to network 2022-11-07 12:26:15 +00:00
iucv net: keep sk->sk_forward_alloc as small as possible 2022-06-10 16:21:27 -07:00
kcm kcm: close race conditions on sk_receive_queue 2022-11-15 12:42:26 +01:00
key Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec 2022-08-24 12:51:50 +01:00
l2tp l2tp: Serialize access to sk_user_data with sk_callback_lock 2022-11-16 12:52:19 +00:00
l3mdev
lapb
llc net: rename reference+tracking helpers 2022-06-09 21:52:55 -07:00
mac80211 wifi: mac80211: Set TWT Information Frame Disabled bit as 1 2022-11-02 09:50:40 +01:00
mac802154 mac802154: Fix LQI recording 2022-10-24 11:07:39 +02:00
mctp mctp: Fix an error handling path in mctp_init() 2022-11-09 19:26:08 -08:00
mpls net: Use u64_stats_fetch_begin_irq() for stats fetch. 2022-08-29 13:02:27 +01:00
mptcp mptcp: fix abba deadlock on fastopen 2022-10-24 21:13:56 -07:00
ncsi genetlink: start to validate reserved header bytes 2022-08-29 12:47:15 +01:00
netfilter netfilter: nf_tables: do not set up extensions for end interval 2022-11-18 15:21:32 +01:00
netlabel genetlink: start to validate reserved header bytes 2022-08-29 12:47:15 +01:00
netlink genetlink: limit the use of validation workarounds to old ops 2022-10-27 08:20:21 -07:00
netrom
nfc nfc/nci: fix race with opening and closing 2022-11-18 12:37:11 +00:00
nsh
openvswitch netfilter: conntrack: Fix data-races around ct mark 2022-11-18 15:21:00 +01:00
packet treewide: use prandom_u32_max() when possible, part 1 2022-10-11 17:42:55 -06:00
phonet
psample genetlink: start to validate reserved header bytes 2022-08-29 12:47:15 +01:00
qrtr net: qrtr: start MHI channel after endpoit creation 2022-08-15 11:21:42 +01:00
rds treewide: use get_random_{u8,u16}() when possible, part 2 2022-10-11 17:42:58 -06:00
rfkill
rose rose: Fix NULL pointer dereference in rose_send_frame() 2022-11-02 11:57:30 +00:00
rxrpc rxrpc: Fix race between conn bundle lookup and bundle removal [ZDI-CAN-15975] 2022-11-18 12:05:44 +00:00
sched netfilter: conntrack: Fix data-races around ct mark 2022-11-18 15:21:00 +01:00
sctp sctp: clear out_curr if all frag chunks of current msg are pruned 2022-11-07 19:59:01 -08:00
smc net/smc: Fix possible leaked pernet namespace in smc_init() 2022-11-02 20:42:09 -07:00
strparser strparser: pad sk_skb_cb to avoid straddling cachelines 2022-07-08 18:38:44 -07:00
sunrpc SUNRPC: Fix crasher in gss_unwrap_resp_integ() 2022-10-27 15:52:10 -04:00
switchdev net: rename reference+tracking helpers 2022-06-09 21:52:55 -07:00
tipc tipc: add an extra conn_get in tipc_conn_alloc 2022-11-21 20:45:24 -08:00
tls net/tls: Fix memory leak in tls_enc_skb() and tls_sw_fallback_init() 2022-11-11 20:08:17 -08:00
unix net: remove SOCK_SUPPORT_ZC from sockmap 2022-10-28 20:21:25 -07:00
vmw_vsock vsock: fix possible infinite sleep in vsock_connectible_wait_data() 2022-11-03 10:49:29 +01:00
wireless wifi: cfg80211: Fix bitrates overflow issue 2022-10-21 12:36:35 +02:00
x25 net/x25: Fix skb leak in x25_lapb_receive_frame() 2022-11-15 20:22:19 -08:00
xdp Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2022-10-03 17:44:18 -07:00
xfrm treewide: use prandom_u32_max() when possible, part 1 2022-10-11 17:42:55 -06:00
compat.c net: clear msg_get_inq in __get_compat_msghdr() 2022-09-20 08:23:20 -07:00
devres.c
Kconfig Remove DECnet support from kernel 2022-08-22 14:26:30 +01:00
Kconfig.debug net: make NET_(DEV|NS)_REFCNT_TRACKER depend on NET 2022-09-20 14:23:56 -07:00
Makefile Remove DECnet support from kernel 2022-08-22 14:26:30 +01:00
socket.c d_path pile 2022-10-06 16:55:41 -07:00
sysctl_net.c