Sean Tranchetti 978e0388c2 af_key: unconditionally clone on broadcast ... [ Upstream commit fc2d5cfdcf ] Attempting to avoid cloning the skb when broadcasting by inflating the refcount with sock_hold/sock_put while under RCU lock is dangerous and violates RCU principles. It leads to subtle race conditions when attempting to free the SKB, as we may reference sockets that have already been freed by the stack. Unable to handle kernel paging request at virtual address 6b6b6b6b6b6c4b [006b6b6b6b6b6c4b] address between user and kernel address ranges Internal error: Oops: 96000004 [#1] PREEMPT SMP task: fffffff78f65b380 task.stack: ffffff8049a88000 pc : sock_rfree+0x38/0x6c lr : skb_release_head_state+0x6c/0xcc Process repro (pid: 7117, stack limit = 0xffffff8049a88000) Call trace: sock_rfree+0x38/0x6c skb_release_head_state+0x6c/0xcc skb_release_all+0x1c/0x38 __kfree_skb+0x1c/0x30 kfree_skb+0xd0/0xf4 pfkey_broadcast+0x14c/0x18c pfkey_sendmsg+0x1d8/0x408 sock_sendmsg+0x44/0x60 ___sys_sendmsg+0x1d0/0x2a8 __sys_sendmsg+0x64/0xb4 SyS_sendmsg+0x34/0x4c el0_svc_naked+0x34/0x38 Kernel panic - not syncing: Fatal exception Suggested-by: Eric Dumazet <eric.dumazet@gmail.com> Signed-off-by: Sean Tranchetti <stranche@codeaurora.org> Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com> Signed-off-by: Sasha Levin <sashal@kernel.org>		2019-03-23 20:09:48 +01:00
..
6lowpan	6lowpan: iphc: reset mac_header after decompress to fix panic	2018-07-06 12:32:12 +02:00
9p	9p/net: fix memory leak in p9_client_create	2019-03-23 20:09:38 +01:00
802
8021q	net: remove blank lines at end of file	2018-07-24 14:10:43 -07:00
appletalk	Revert changes to convert to ->poll_mask() and aio IOCB_CMD_POLL	2018-06-28 10:40:47 -07:00
atm	Revert "net: simplify sock_poll_wait"	2018-11-04 14:50:51 +01:00
ax25	ax25: fix possible use-after-free	2019-02-23 09:07:27 +01:00
batman-adv	batman-adv: release station info tidstats	2019-03-13 14:02:34 -07:00
bluetooth	Bluetooth: Fix locking in bt_accept_enqueue() for BH context	2019-03-10 07:17:21 +01:00
bpf	bpf/test_run: support cgroup local storage	2018-08-03 00:47:32 +02:00
bpfilter	net: bpfilter: use get_pid_task instead of pid_task	2018-10-17 22:03:40 -07:00
bridge	netfilter: ebtables: compat: un-break 32bit setsockopt when no rules are present	2019-03-13 14:02:29 -07:00
caif	Revert "net: simplify sock_poll_wait"	2018-11-04 14:50:51 +01:00
can	can: bcm: check timer values before ktime conversion	2019-01-31 08:14:39 +01:00
ceph	libceph: handle an empty authorize reply	2019-02-27 10:08:50 +01:00
core	bpf: only adjust gso_size on bytestream protocols	2019-03-23 20:09:48 +01:00
dcb	net: dcb: Add priority-to-DSCP map getters	2018-07-27 13:17:50 -07:00
dccp	dccp: fool proof ccid_hc_[rt]x_parse_options()	2019-02-12 19:47:21 +01:00
decnet	decnet: fix using plain integer as NULL warning	2018-08-09 14:11:24 -07:00
dns_resolver	net: remove blank lines at end of file	2018-07-24 14:10:43 -07:00
dsa	net: dsa: slave: Don't propagate flag changes on down slave interfaces	2019-02-12 19:47:22 +01:00
ethernet	net: Convert GRO SKB handling to list_head.	2018-06-26 11:33:04 +09:00
hsr	net/hsr: fix possible crash in add_timer()	2019-03-19 13:12:38 +01:00
ieee802154	ieee802154: lowpan_header_create check must check daddr	2019-01-09 17:38:31 +01:00
ife
ipv4	esp: Skip TX bytes accounting when sending from a request socket	2019-03-23 20:09:48 +01:00
ipv6	esp: Skip TX bytes accounting when sending from a request socket	2019-03-23 20:09:48 +01:00
iucv	Revert "net: simplify sock_poll_wait"	2018-11-04 14:50:51 +01:00
kcm	Revert "kcm: remove any offset before parsing messages"	2018-09-17 18:43:42 -07:00
key	af_key: unconditionally clone on broadcast	2019-03-23 20:09:48 +01:00
l2tp	l2tp: fix infoleak in l2tp_ip6_recvmsg()	2019-03-19 13:12:38 +01:00
l3mdev
lapb
llc	llc: do not use sk_eat_skb()	2018-12-01 09:37:27 +01:00
mac80211	mac80211: Fix Tx aggregation session tear down with ITXQs	2019-03-23 20:09:45 +01:00
mac802154	net: mac802154: tx: expand tailroom if necessary	2018-08-06 11:21:37 +02:00
mpls	mpls: Return error for RTA_GATEWAY attribute	2019-03-10 07:17:19 +01:00
ncsi	net/ncsi: Fixup .dumpit message flags and ID check in Netlink handler	2018-08-22 21:39:08 -07:00
netfilter	ipvs: fix dependency on nf_defrag_ipv6	2019-03-23 20:09:45 +01:00
netlabel	netlabel: fix out-of-bounds memory accesses	2019-03-10 07:17:18 +01:00
netlink	Merge ra.kernel.org:/pub/scm/linux/kernel/git/davem/net	2018-08-05 13:04:31 -07:00
netrom	netrom: switch to sock timer API	2019-02-06 17:30:07 +01:00
nfc	net: nfc: Fix NULL dereference on nfc_llcp_build_tlv fails	2019-03-10 07:17:18 +01:00
nsh	nsh: set mac len based on inner packet	2018-07-12 16:55:29 -07:00
openvswitch	openvswitch: Avoid OOB read when parsing flow nlattrs	2019-01-31 08:14:32 +01:00
packet	net/packet: fix 4gb buffer limit due to overflow check	2019-02-27 10:08:58 +01:00
phonet	Revert changes to convert to ->poll_mask() and aio IOCB_CMD_POLL	2018-06-28 10:40:47 -07:00
psample
qrtr	net: qrtr: Reset the node and port ID of broadcast messages	2018-07-05 20:20:03 +09:00
rds	rds: fix refcount bug in rds_sock_addref	2019-02-12 19:47:22 +01:00
rfkill	Here are quite a large number of fixes, notably:	2018-09-03 22:12:02 -07:00
rose	net/rose: fix NULL ax25_cb kernel panic	2019-02-06 17:30:07 +01:00
rxrpc	rxrpc: Fix client call queueing, waiting for channel	2019-03-19 13:12:39 +01:00
sched	net: sched: flower: insert new filter to idr after setting its mask	2019-03-19 13:12:41 +01:00
sctp	sctp: remove sched init from sctp_stream_init	2019-03-19 13:12:39 +01:00
smc	net/smc: fix smc_poll in SMC_INIT state	2019-03-19 13:12:41 +01:00
strparser	strparser: remove redundant variable 'rd_desc'	2018-08-01 10:00:06 -07:00
sunrpc	xprtrdma: Make sure Send CQ is allocated on an existing compvec	2019-03-23 20:09:45 +01:00
switchdev
tipc	tipc: fix race condition causing hung sendto	2019-03-10 07:17:18 +01:00
tls	net/tls: Init routines in create_ctx	2019-01-13 09:51:00 +01:00
unix	missing barriers in some of unix_sock ->addr and ->path accesses	2019-03-19 13:12:41 +01:00
vmw_vsock	vsock/virtio: reset connected sockets on device removal	2019-03-13 14:02:36 -07:00
wimax	wimax: remove blank lines at EOF	2018-07-24 14:10:42 -07:00
wireless	cfg80211: extend range deviation for DMG	2019-03-05 17:58:52 +01:00
x25	net/x25: fix a race in x25_bind()	2019-03-19 13:12:40 +01:00
xdp	xsk: do not call synchronize_net() under RCU read lock	2018-10-11 10:19:01 +02:00
xfrm	xfrm: refine validation of template and selector families	2019-02-15 08:10:13 +01:00
compat.c	sock: Make sock->sk_stamp thread-safe	2019-01-09 17:38:33 +01:00
Kconfig	net: remove blank lines at end of file	2018-07-24 14:10:43 -07:00
Makefile	bpfilter: check compiler capability in Kconfig	2018-06-28 13:36:39 +09:00
socket.c	net: socket: set sock->sk to NULL after calling proto_ops::release()	2019-03-10 07:17:18 +01:00
sysctl_net.c