Antoine Tenart d225b0ac96 gro: fix ownership transfer ... commit ed4cccef64 upstream. If packets are GROed with fraglist they might be segmented later on and continue their journey in the stack. In skb_segment_list those skbs can be reused as-is. This is an issue as their destructor was removed in skb_gro_receive_list but not the reference to their socket, and then they can't be orphaned. Fix this by also removing the reference to the socket. For example this could be observed, kernel BUG at include/linux/skbuff.h:3131! (skb_orphan) RIP: 0010:ip6_rcv_core+0x11bc/0x19a0 Call Trace: ipv6_list_rcv+0x250/0x3f0 __netif_receive_skb_list_core+0x49d/0x8f0 netif_receive_skb_list_internal+0x634/0xd40 napi_complete_done+0x1d2/0x7d0 gro_cell_poll+0x118/0x1f0 A similar construction is found in skb_gro_receive, apply the same change there. Fixes: 5e10da5385 ("skbuff: allow 'slow_gro' for skb carring sock reference") Signed-off-by: Antoine Tenart <atenart@kernel.org> Reviewed-by: Willem de Bruijn <willemb@google.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2024-04-10 16:19:43 +02:00
..
6lowpan	…
9p	net: 9p: avoid freeing uninit memory in p9pdu_vreadf	2024-01-05 15:13:34 +01:00
802	mrp: introduce active flags to prevent UAF when applicant uninit	2022-12-31 13:14:42 +01:00
8021q	vlan: skip nested type that is not IFLA_VLAN_QOS_MAPPING	2024-02-23 08:54:27 +01:00
appletalk	appletalk: Fix Use-After-Free in atalk_ioctl	2023-12-20 15:17:37 +01:00
atm	atm: Fix Use-After-Free in do_vcc_ioctl	2023-12-20 15:17:35 +01:00
ax25	…
batman-adv	net: vlan: introduce skb_vlan_eth_hdr()	2023-12-20 15:17:35 +01:00
bluetooth	Bluetooth: Fix TOCTOU in HCI debugfs implementation	2024-04-10 16:19:37 +02:00
bpf	bpf: Move skb->len == 0 checks into __bpf_redirect	2022-12-31 13:14:11 +01:00
bpfilter	…
bridge	netfilter: validate user input for expected length	2024-04-10 16:19:38 +02:00
caif	net: caif: Fix use-after-free in cfusbl_device_notify()	2023-03-17 08:48:54 +01:00
can	can: j1939: Fix UAF in j1939_sk_match_filter during setsockopt(SO_J1939_FILTER)	2024-02-23 08:55:10 +01:00
ceph	libceph: use kernel_connect()	2023-10-19 23:05:36 +02:00
core	gro: fix ownership transfer	2024-04-10 16:19:43 +02:00
dcb	net: dcb: choose correct policy to parse DCB_ATTR_BCN	2023-08-11 15:13:53 +02:00
dccp	net: inet: Retire port only listening_hash	2023-11-28 16:56:22 +00:00
dns_resolver	keys, dns: Fix size check of V1 server-list header	2024-01-25 14:52:46 -08:00
dsa	net: dsa: tag_sja1105: fix MAC DA patching from meta frames	2023-07-23 13:47:30 +02:00
ethernet	…
ethtool	ethtool: netlink: Add missing ethnl_ops_begin/complete	2024-01-25 14:52:54 -08:00
hsr	hsr: Handle failures in module init	2024-03-26 18:21:36 -04:00
ieee802154	net: ieee802154: fix error return code in dgram_bind()	2022-11-03 23:59:14 +09:00
ife	net: sched: ife: fix potential use-after-free	2024-01-05 15:13:29 +01:00
ipv4	udp: prevent local UDP tunnel packets from being GROed	2024-04-10 16:19:39 +02:00
ipv6	udp: do not transition UDP GRO fraglist partial checksums to unnecessary	2024-04-10 16:19:39 +02:00
iucv	net/iucv: fix the allocation size of iucv_path_table array	2024-03-26 18:21:13 -04:00
kcm	net: kcm: fix incorrect parameter validation in the kcm_getsockopt) function	2024-03-26 18:21:23 -04:00
key	net: af_key: fix sadb_x_filter validation	2023-08-26 14:23:32 +02:00
l2tp	l2tp: fix incorrect parameter validation in the pppol2tp_getsockopt() function	2024-03-26 18:21:23 -04:00
l3mdev	…
lapb	…
llc	llc: call sock_orphan() at release time	2024-02-23 08:54:54 +01:00
mac80211	wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes	2024-04-10 16:19:31 +02:00
mac802154	mac802154: fix llsec key resources release in mac802154_llsec_key_del	2024-04-10 16:18:39 +02:00
mctp	mctp: perform route lookups under a RCU read-side lock	2023-10-25 11:58:59 +02:00
mpls	net: mpls: fix stale pointer if allocation fails during device rename	2023-02-22 12:57:09 +01:00
mptcp	mptcp: don't account accept() of non-MPC client as fallback to TCP	2024-04-10 16:19:43 +02:00
ncsi	net/ncsi: Fix netlink major/minor version numbers	2024-01-25 14:52:36 -08:00
netfilter	netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get()	2024-04-10 16:19:38 +02:00
netlabel	calipso: fix memory leak in netlbl_calipso_add_pass()	2024-01-25 14:52:33 -08:00
netlink	netlink: Fix kernel-infoleak-after-free in __skb_datagram_iter	2024-03-06 14:38:45 +00:00
netrom	netrom: Fix data-races around sysctl_net_busy_read	2024-03-15 10:48:17 -04:00
nfc	nfc: nci: Fix uninit-value in nci_dev_up and nci_ntf_packet	2024-04-10 16:19:35 +02:00
nsh	net: nsh: Use correct mac_offset to unwind gso skb in nsh_gso_segment()	2023-05-24 17:36:51 +01:00
openvswitch	net: openvswitch: limit the number of recursions from action sets	2024-02-23 08:55:02 +01:00
packet	packet: annotate data-races around ignore_outgoing	2024-03-26 18:21:35 -04:00
phonet	…
psample	psample: Require 'CAP_NET_ADMIN' when joining "packets" group	2023-12-13 18:36:37 +01:00
qrtr	net: qrtr: ns: Return 0 if server port is not present	2024-01-25 14:52:30 -08:00
rds	net/rds: fix possible cp null dereference	2024-04-10 16:19:37 +02:00
rfkill	net: rfkill: gpio: set GPIO direction	2024-01-05 15:13:34 +01:00
rose	net/rose: fix races in rose_kill_by_device()	2024-01-05 15:13:29 +01:00
rxrpc	rxrpc: Fix response to PING RESPONSE ACKs to a dead call	2024-02-23 08:54:58 +01:00
sched	net/sched: act_skbmod: prevent kernel-infoleak	2024-04-10 16:19:38 +02:00
sctp	sctp: update hb timer immediately after users change hb_interval	2023-10-10 21:59:08 +02:00
smc	net/smc: fix illegal rmb_desc access in SMC-D connection dump	2024-02-23 08:54:27 +01:00
strparser	…
sunrpc	nfsd: fix double fget() bug in __write_ports_addfd()	2024-04-10 16:19:28 +02:00
switchdev	…
tipc	tipc: Check the bearer type before calling tipc_udp_nl_bearer_add()	2024-02-23 08:54:58 +01:00
tls	Revert "tls: rx: move counting TlsDecryptErrors for sync"	2024-03-06 14:38:51 +00:00
unix	af_unix: Annotate data-race of gc_in_progress in wait_for_unix_gc().	2024-03-26 18:21:17 -04:00
vmw_vsock	virtio/vsock: fix logic which reduces credit update messages	2024-01-25 14:52:38 -08:00
wireless	wifi: nl80211: reject iftype change with mesh ID change	2024-03-06 14:38:48 +00:00
x25	net/x25: fix incorrect parameter validation in the x25_getsockopt() function	2024-03-26 18:21:23 -04:00
xdp	xsk: Fix xsk_diag use-after-free error during socket cleanup	2023-09-19 12:22:58 +02:00
xfrm	xfrm: Avoid clang fortify warning in copy_to_user_tmpl()	2024-04-10 16:18:45 +02:00
Kconfig	Remove DECnet support from kernel	2023-06-21 15:59:15 +02:00
Makefile	Remove DECnet support from kernel	2023-06-21 15:59:15 +02:00
compat.c	…
devres.c	…
socket.c	net: Save and restore msg_namelen in sock_sendmsg	2024-01-15 18:51:16 +01:00
sysctl_net.c	…