mirrors/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2024-09-12 21:57:43 +00:00
Code Issues Releases Wiki Activity
linux-stable/net
History
Xin Long cb8092d70a tipc: move bc link creation back to tipc_node_create 
Shuang Li reported a NULL pointer dereference crash:

  [] BUG: kernel NULL pointer dereference, address: 0000000000000068
  [] RIP: 0010:tipc_link_is_up+0x5/0x10 [tipc]
  [] Call Trace:
  []  <IRQ>
  []  tipc_bcast_rcv+0xa2/0x190 [tipc]
  []  tipc_node_bc_rcv+0x8b/0x200 [tipc]
  []  tipc_rcv+0x3af/0x5b0 [tipc]
  []  tipc_udp_recv+0xc7/0x1e0 [tipc]

It was caused by the 'l' passed into tipc_bcast_rcv() is NULL. When it
creates a node in tipc_node_check_dest(), after inserting the new node
into hashtable in tipc_node_create(), it creates the bc link. However,
there is a gap between this insert and bc link creation, a bc packet
may come in and get the node from the hashtable then try to dereference
its bc link, which is NULL.

This patch is to fix it by moving the bc link creation before inserting
into the hashtable.

Note that for a preliminary node becoming "real", the bc link creation
should also be called before it's rehashed, as we don't create it for
preliminary nodes.

Fixes: 4cbf8ac2fe ("tipc: enable creating a "preliminary" node")
Reported-by: Shuang Li <shuali@redhat.com>
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Acked-by: Jon Maloy <jmaloy@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2022-06-27 11:51:56 +01:00
..
6lowpan net: don't include ndisc.h from ipv6.h 2022-02-04 14:15:11 -08:00
9p xen: switch gnttab_end_foreign_access() to take a struct page pointer 2022-05-27 11:05:29 +02:00
802 net: 802: Use memset_startat() to clear struct fields 2021-11-19 11:23:23 +00:00
8021q net: add netif_inherit_tso_max() 2022-05-06 12:07:56 +01:00
appletalk net: remove noblock parameter from skb_recv_datagram() 2022-04-06 13:45:26 +01:00
atm net: SO_RCVMARK socket option for SO_MARK with recvmsg() 2022-04-28 13:08:15 -07:00
ax25 net: ax25: Fix deadlock caused by skb_recv_datagram in ax25_recvmsg 2022-06-15 13:00:22 +01:00
batman-adv net: wrap the wireless pointers in struct net_device in an ifdef 2022-05-22 21:51:54 +01:00
bluetooth bluetooth: don't use bitmaps for random flag accesses 2022-06-05 16:28:41 -07:00
bpf Merge https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next 2022-05-23 16:07:14 -07:00
bpfilter uaccess: remove CONFIG_SET_FS 2022-02-25 09:36:06 +01:00
bridge Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2022-05-19 11:23:59 -07:00
caif net: remove noblock parameter from skb_recv_datagram() 2022-04-06 13:45:26 +01:00
can can: isotp: isotp_bind(): do not validate unused address information 2022-05-19 22:11:28 +02:00
ceph libceph: use swap() macro instead of taking tmp variable 2022-05-25 20:45:13 +02:00
core sock: redo the psock vs ULP protection check 2022-06-23 10:08:30 +02:00
dcb net: dcb: disable softirqs in dcbnl_flush_dev() 2022-03-03 08:01:55 -08:00
dccp Revert "net: Add a second bind table hashed by port and address" 2022-06-16 11:07:59 -07:00
decnet dn_route: set rt neigh to blackhole_netdev instead of loopback_dev in ifdown 2022-05-17 18:03:23 -07:00
dns_resolver
dsa net: dsa: OF-ware slave_mii_bus 2022-05-23 12:27:53 +01:00
ethernet net: ethernet: set default assignment identifier to NET_NAME_ENUM 2022-04-07 21:04:03 -07:00
ethtool ethtool: Fix get module eeprom fallback 2022-06-17 20:22:16 -07:00
hsr net: add per-cpu storage and net->core_stats 2022-03-11 23:17:24 -08:00
ieee802154 net: SO_RCVMARK socket option for SO_MARK with recvmsg() 2022-04-28 13:08:15 -07:00
ife
ipv4 tunnels: do not assume mac header is set in skb_tunnel_check_pmtu() 2022-06-27 11:50:30 +01:00
ipv6 erspan: do not assume transport header is always set 2022-06-20 10:00:55 +01:00
iucv net: remove noblock parameter from skb_recv_datagram() 2022-04-06 13:45:26 +01:00
kcm net: Don't include filter.h from net/sock.h 2021-12-29 08:48:14 -08:00
key Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec 2022-06-01 17:44:04 -07:00
l2tp ipv6: Fix signed integer overflow in l2tp_ip6_sendmsg 2022-06-08 10:56:43 -07:00
l3mdev l3mdev: l3mdev_master_upper_ifindex_by_index_rcu should be using netdev_master_upper_dev_get_rcu 2022-04-15 14:27:24 -07:00
lapb
llc llc: only change llc->dev when bind() succeeds 2022-03-25 16:55:41 -07:00
mac80211 wifi: mac80211: fix use-after-free in chanctx code 2022-06-01 12:41:41 +03:00
mac802154 net: mac802154: Fix symbol durations 2022-04-30 20:29:47 +02:00
mctp Networking changes for 5.19. 2022-05-25 12:22:58 -07:00
mpls net: mpls: fix memdup.cocci warning 2022-04-07 21:06:41 -07:00
mptcp Merge https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next 2022-05-23 16:07:14 -07:00
ncsi net/ncsi: use proper "mellanox" DT vendor prefix 2022-06-23 20:51:06 -07:00
netfilter netfilter: nf_dup_netdev: add and use recursion counter 2022-06-21 10:50:41 +02:00
netlabel netlabel: fix out-of-bounds memory accesses 2022-03-21 10:59:11 +00:00
netlink Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2022-05-12 16:15:30 -07:00
netrom net: remove noblock parameter from skb_recv_datagram() 2022-04-06 13:45:26 +01:00
nfc net: nfc: Directly use ida_alloc()/free() 2022-05-28 15:28:47 +01:00
nsh
openvswitch net: openvswitch: fix parsing of nw_proto for IPv6 fragments 2022-06-23 11:44:01 +02:00
packet net/af_packet: make sure to pull mac header 2022-06-02 10:15:05 -07:00
phonet net: remove noblock parameter from recvmsg() entities 2022-04-12 15:00:25 +02:00
psample
qrtr net: remove noblock parameter from skb_recv_datagram() 2022-04-06 13:45:26 +01:00
rds Linux 5.18 2022-05-24 12:40:28 -03:00
rfkill rfkill: make new event layout opt-in 2022-03-18 13:09:17 +02:00
rose ROSE: Remove unused code and clean up some inconsistent indenting 2022-05-09 17:19:27 -07:00
rxrpc Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2022-05-23 21:19:17 -07:00
sched net/sched: sch_netem: Fix arithmetic in netem_dump() for 32-bit platforms 2022-06-17 20:29:38 -07:00
sctp stcp: Use memset_after() to zero sctp_stream_out_ext 2022-05-20 17:42:53 -07:00
smc net/smc: fixes for converting from "struct smc_cdc_tx_pend **" to "struct smc_wr_tx_pend_priv *" 2022-05-28 12:36:26 +01:00
strparser bpf: sockmap, strparser, and tls are reusing qdisc_skb_cb and colliding 2021-11-09 01:05:28 +01:00
sunrpc NFS Client Fixes for Linux 5.19-rc 2022-06-17 15:17:57 -05:00
switchdev net: switchdev: remove lag_mod_cb from switchdev_handle_fdb_event_to_device 2022-02-24 21:31:43 -08:00
tipc tipc: move bc link creation back to tipc_node_create 2022-06-27 11:51:56 +01:00
tls sock: redo the psock vs ULP protection check 2022-06-23 10:08:30 +02:00
unix af_unix: Fix a data-race in unix_dgram_peer_wake_me(). 2022-06-07 12:07:46 +02:00
vmw_vsock hyperv-next for 5.19 2022-05-28 11:39:01 -07:00
wireless wireless-next patches for v5.19 2022-05-19 13:01:08 -07:00
x25 x25: remove redundant pointer dev 2022-05-10 11:59:22 +02:00
xdp xsk: Fix generic transmit when completion queue reservation fails 2022-06-14 16:49:29 +02:00
xfrm Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec 2022-06-01 17:44:04 -07:00
compat.c
devres.c
Kconfig page_pool: Add allocation stats 2022-03-03 09:55:28 +00:00
Kconfig.debug net: CONFIG_DEBUG_NET depends on CONFIG_NET 2022-06-02 10:15:05 -07:00
Makefile mctp: Add MCTP base 2021-07-29 15:06:49 +01:00
socket.c net: clear msg_get_inq in __sys_recvfrom() and __copy_msghdr_from_user() 2022-06-23 20:56:23 -07:00
sysctl_net.c sections: move and rename core_kernel_data() to is_kernel_core_data() 2021-11-09 10:02:50 -08:00