Lee Jones 04c55383fa net/sched: cls_u32: Fix reference counter leak leading to overflow ... In the event of a failure in tcf_change_indev(), u32_set_parms() will immediately return without decrementing the recently incremented reference counter. If this happens enough times, the counter will rollover and the reference freed, leading to a double free which can be used to do 'bad things'. In order to prevent this, move the point of possible failure above the point where the reference counter is incremented. Also save any meaningful return values to be applied to the return data at the appropriate point in time. This issue was caught with KASAN. Fixes: 705c709126 ("net: sched: cls_u32: no need to call tcf_exts_change for newly allocated struct") Suggested-by: Eric Dumazet <edumazet@google.com> Signed-off-by: Lee Jones <lee@kernel.org> Reviewed-by: Eric Dumazet <edumazet@google.com> Acked-by: Jamal Hadi Salim <jhs@mojatatu.com> Signed-off-by: David S. Miller <davem@davemloft.net>		2023-06-09 11:40:17 +01:00
..
6lowpan	6lowpan: Remove redundant initialisation.	2023-03-29 08:22:52 +01:00
9p	Including fixes from netfilter.	2023-05-05 19:12:01 -07:00
802
8021q	vlan: fix a potential uninit-value in vlan_dev_hard_start_xmit()	2023-05-17 12:55:39 +01:00
appletalk
atm	atm: hide unused procfs functions	2023-05-17 21:27:30 -07:00
ax25
batman-adv	batman-adv: Broken sync while rescheduling delayed work	2023-05-26 23:14:49 +02:00
bluetooth	Bluetooth: L2CAP: Add missing checks for invalid DCID	2023-06-05 17:24:14 -07:00
bpf	bpf: add test_run support for netfilter program type	2023-04-21 11:34:50 -07:00
bpfilter
bridge	bridge: always declare tunnel functions	2023-05-17 21:28:58 -07:00
caif	net: caif: Fix use-after-free in cfusbl_device_notify()	2023-03-02 22:22:07 -08:00
can	can: j1939: avoid possible use-after-free when j1939_can_rx_register fails	2023-06-05 08:26:40 +02:00
ceph	Networking changes for 6.3.	2023-02-21 18:24:12 -08:00
core	bpf-for-netdev	2023-06-07 21:47:11 -07:00
dcb
dccp	netfilter: keep conntrack reference until IPsecv6 policy checks are done	2023-03-22 21:50:23 +01:00
devlink	devlink: Fix crash with CONFIG_NET_NS=n	2023-05-16 19:57:52 -07:00
dns_resolver
dsa	net: dsa: tag_ocelot: call only the relevant portion of __skb_vlan_pop() on TX	2023-04-23 14:16:45 +01:00
ethernet
ethtool	ethtool: Fix uninitialized number of lanes	2023-05-03 09:13:20 +01:00
handshake	net/handshake: Enable the SNI extension to work properly	2023-05-24 22:05:24 -07:00
hsr	hsr: ratelimit only when errors are printed	2023-03-16 21:11:03 -07:00
ieee802154	net: ieee802154: remove an unnecessary null pointer check	2023-03-17 09:13:53 +01:00
ife
ipv4	tcp: gso: really support BIG TCP	2023-06-06 21:07:43 -07:00
ipv6	ping6: Fix send to link-local addresses with VRF.	2023-06-08 18:59:57 -07:00
iucv	net/iucv: Fix size of interrupt data	2023-03-16 17:34:40 -07:00
kcm
key	af_key: Reject optional tunnel/BEET mode templates in outbound policies	2023-05-10 07:04:51 +02:00
l2tp	l2tp: generate correct module alias strings	2023-03-31 09:25:12 +01:00
l3mdev
lapb
llc	net: deal with most data-races in sk_wait_event()	2023-05-10 10:03:32 +01:00
mac80211	wifi: mac80211: fix switch count in EMA beacons	2023-06-06 10:20:45 +02:00
mac802154	mac802154: Rename kfree_rcu() to kvfree_rcu_mightsleep()	2023-04-05 13:48:04 +00:00
mctp	mctp: remove MODULE_LICENSE in non-modules	2023-03-09 23:06:21 -08:00
mpls	net: mpls: fix stale pointer if allocation fails during device rename	2023-02-15 10:26:37 +00:00
mptcp	mptcp: update userspace pm infos	2023-06-05 15:15:57 +01:00
ncsi	net/ncsi: clear Tx enable mode when handling a Config required AEN	2023-04-28 09:35:33 +01:00
netfilter	netfilter: nf_tables: out-of-bound check in chain blob	2023-06-07 00:43:44 +02:00
netlabel
netlink	net/netlink: fix NETLINK_LIST_MEMBERSHIPS length report	2023-05-31 00:02:24 -07:00
netrom	netrom: fix info-leak in nr_write_internal()	2023-05-25 21:02:29 -07:00
nfc	nfc: change order inside nfc_se_io error path	2023-03-07 13:37:05 -08:00
nsh	net: nsh: Use correct mac_offset to unwind gso skb in nsh_gso_segment()	2023-05-15 08:40:27 +01:00
openvswitch	net: openvswitch: fix upcall counter access before allocation	2023-06-07 12:25:05 +01:00
packet	af_packet: do not use READ_ONCE() in packet_bind()	2023-05-29 22:03:48 -07:00
phonet
psample
qrtr	net: qrtr: Fix an uninit variable access bug in qrtr_tx_resume()	2023-04-13 09:35:30 +02:00
rds	rds: rds_rm_zerocopy_callback() correct order for list_add_tail()	2023-02-13 09:33:39 +00:00
rfkill	net: rfkill-gpio: Add explicit include for of.h	2023-04-06 20:36:27 +02:00
rose	net/rose: Fix to not accept on connected socket	2023-01-28 00:19:57 -08:00
rxrpc	rxrpc: Truncate UTS_RELEASE for rxrpc version	2023-05-30 10:01:06 +02:00
sched	net/sched: cls_u32: Fix reference counter leak leading to overflow	2023-06-09 11:40:17 +01:00
sctp	sctp: fix an issue that plpmtu can never go to complete state	2023-05-22 11:05:20 +01:00
smc	net/smc: Avoid to access invalid RMBs' MRs in SMCRv1 ADD LINK CONT	2023-06-03 20:51:04 +01:00
strparser
sunrpc	nfsd-6.4 fixes:	2023-06-02 13:38:55 -04:00
switchdev
tipc	tipc: check the bearer min mtu properly when setting it by netlink	2023-05-15 10:21:20 +01:00
tls	tls: improve lockless access safety of tls_err_abort()	2023-05-26 10:35:58 +01:00
unix	bpf, sockmap: Pass skb ownership through read_skb	2023-05-23 16:09:47 +02:00
vmw_vsock	bpf, sockmap: Pass skb ownership through read_skb	2023-05-23 16:09:47 +02:00
wireless	wifi: cfg80211: fix locking in regulatory disconnect	2023-06-06 14:51:32 +02:00
x25	net/x25: Fix to not accept on connected socket	2023-01-25 09:51:04 +00:00
xdp	bpf-next-for-netdev	2023-04-13 16:43:38 -07:00
xfrm	ipsec-2023-05-16	2023-05-16 20:52:35 -07:00
compat.c	net/compat: Update msg_control_is_user when setting a kernel pointer	2023-04-14 11:09:27 +01:00
devres.c
Kconfig	net/handshake: Add Kunit tests for the handshake consumer API	2023-04-19 18:48:48 -07:00
Kconfig.debug
Makefile	net/handshake: Create a NETLINK service for handling handshake requests	2023-04-19 18:48:48 -07:00
socket.c	net: annotate sk->sk_err write from do_recvmmsg()	2023-05-10 09:58:29 +01:00
sysctl_net.c