Antoine Tenart fc126c1d51 gro: fix ownership transfer ... commit ed4cccef64 upstream. If packets are GROed with fraglist they might be segmented later on and continue their journey in the stack. In skb_segment_list those skbs can be reused as-is. This is an issue as their destructor was removed in skb_gro_receive_list but not the reference to their socket, and then they can't be orphaned. Fix this by also removing the reference to the socket. For example this could be observed, kernel BUG at include/linux/skbuff.h:3131! (skb_orphan) RIP: 0010:ip6_rcv_core+0x11bc/0x19a0 Call Trace: ipv6_list_rcv+0x250/0x3f0 __netif_receive_skb_list_core+0x49d/0x8f0 netif_receive_skb_list_internal+0x634/0xd40 napi_complete_done+0x1d2/0x7d0 gro_cell_poll+0x118/0x1f0 A similar construction is found in skb_gro_receive, apply the same change there. Fixes: 5e10da5385 ("skbuff: allow 'slow_gro' for skb carring sock reference") Signed-off-by: Antoine Tenart <atenart@kernel.org> Reviewed-by: Willem de Bruijn <willemb@google.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2024-04-10 16:35:52 +02:00
..
6lowpan
9p	net: 9p: avoid freeing uninit memory in p9pdu_vreadf	2024-01-01 12:42:41 +00:00
802
8021q	vlan: skip nested type that is not IFLA_VLAN_QOS_MAPPING	2024-01-31 16:19:01 -08:00
appletalk	appletalk: Fix Use-After-Free in atalk_ioctl	2023-12-20 17:01:50 +01:00
atm	atm: Fix Use-After-Free in do_vcc_ioctl	2023-12-20 17:01:48 +01:00
ax25	ax25: Kconfig: Update link for linux-ax25.org	2023-09-18 12:56:58 +01:00
batman-adv	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2023-08-24 10:51:39 -07:00
bluetooth	Bluetooth: Fix TOCTOU in HCI debugfs implementation	2024-04-10 16:35:49 +02:00
bpf	bpf: Fix a few selftest failures due to llvm18 change	2024-02-05 20:14:20 +00:00
bpfilter
bridge	netfilter: validate user input for expected length	2024-04-10 16:35:51 +02:00
caif
can	can: j1939: Fix UAF in j1939_sk_match_filter during setsockopt(SO_J1939_FILTER)	2024-02-23 09:25:17 +01:00
ceph	libceph: fail sparse-read if the data length doesn't match	2024-03-01 13:34:56 +01:00
core	gro: fix ownership transfer	2024-04-10 16:35:52 +02:00
dcb	net: dcb: choose correct policy to parse DCB_ATTR_BCN	2023-08-01 21:07:46 -07:00
dccp	dccp/tcp: Call security_inet_conn_request() after setting IPv6 addresses.	2023-11-20 11:59:35 +01:00
devlink	devlink: fix port new reply cmd type	2024-03-26 18:20:11 -04:00
dns_resolver	keys, dns: Fix size check of V1 server-list header	2024-01-25 15:35:41 -08:00
dsa	net: dsa: mark parsed interface mode for legacy switch drivers	2023-08-09 13:08:09 -07:00
ethernet
ethtool	ethtool: netlink: Add missing ethnl_ops_begin/complete	2024-01-25 15:36:00 -08:00
handshake	net/handshake: Fix handshake_req_destroy_test1	2024-02-23 09:24:50 +01:00
hsr	net: hsr: hsr_slave: Fix the promiscuous mode in offload mode	2024-04-10 16:35:42 +02:00
ieee802154	sysctl-6.6-rc1	2023-08-29 17:39:15 -07:00
ife	net: sched: ife: fix potential use-after-free	2024-01-01 12:42:30 +00:00
ipv4	gro: fix ownership transfer	2024-04-10 16:35:52 +02:00
ipv6	netfilter: validate user input for expected length	2024-04-10 16:35:51 +02:00
iucv	net/iucv: fix the allocation size of iucv_path_table array	2024-03-26 18:19:12 -04:00
kcm	net: kcm: fix incorrect parameter validation in the kcm_getsockopt) function	2024-03-26 18:19:40 -04:00
key	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2023-08-18 12:44:56 -07:00
l2tp	l2tp: fix incorrect parameter validation in the pppol2tp_getsockopt() function	2024-03-26 18:19:40 -04:00
l3mdev
lapb
llc	llc: call sock_orphan() at release time	2024-02-05 20:14:36 +00:00
mac80211	wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes	2024-04-03 15:28:54 +02:00
mac802154	mac802154: fix llsec key resources release in mac802154_llsec_key_del	2024-04-03 15:28:27 +02:00
mctp	net: mctp: copy skb ext data when fragmenting	2024-03-26 18:19:34 -04:00
mpls	networking: Update to register_net_sysctl_sz	2023-08-15 15:26:18 -07:00
mptcp	mptcp: fix possible deadlock in subflow diag	2024-03-06 14:48:42 +00:00
ncsi	net/ncsi: Fix netlink major/minor version numbers	2024-01-25 15:35:20 -08:00
netfilter	netfilter: nf_tables: discard table flag update with pending basechain deletion	2024-04-10 16:35:50 +02:00
netlabel	calipso: fix memory leak in netlbl_calipso_add_pass()	2024-01-25 15:35:14 -08:00
netlink	netlink: Fix kernel-infoleak-after-free in __skb_datagram_iter	2024-03-06 14:48:34 +00:00
netrom	netrom: Fix data-races around sysctl_net_busy_read	2024-03-15 10:48:21 -04:00
nfc	nfc: nci: Fix uninit-value in nci_dev_up and nci_ntf_packet	2024-04-10 16:35:41 +02:00
nsh
openvswitch	net: openvswitch: limit the number of recursions from action sets	2024-02-23 09:24:51 +01:00
packet	packet: annotate data-races around ignore_outgoing	2024-03-26 18:20:10 -04:00
phonet	phonet/pep: fix racy skb_queue_empty() use	2024-03-01 13:35:10 +01:00
psample	psample: Require 'CAP_NET_ADMIN' when joining "packets" group	2023-12-13 18:45:10 +01:00
qrtr	net: qrtr: ns: Return 0 if server port is not present	2024-01-20 11:51:47 +01:00
rds	net/rds: fix possible cp null dereference	2024-04-10 16:35:49 +02:00
rfkill	net: rfkill: gpio: set GPIO direction	2024-01-01 12:42:41 +00:00
rose	net/rose: fix races in rose_kill_by_device()	2024-01-01 12:42:31 +00:00
rxrpc	rxrpc: Fix counting of new acks and nacks	2024-02-16 19:10:50 +01:00
sched	net/sched: fix lockdep splat in qdisc_tree_reduce_backlog()	2024-04-10 16:35:51 +02:00
sctp	sctp: fix busy polling	2024-01-25 15:35:30 -08:00
smc	net/smc: disable SEID on non-s390 archs where virtual ISM may be used	2024-02-05 20:14:25 +00:00
strparser
sunrpc	net: sunrpc: Fix an off by one in rpc_sockaddr2uaddr()	2024-03-26 18:20:01 -04:00
switchdev	net: bridge: switchdev: Skip MDB replays of deferred events on offload	2024-03-01 13:35:06 +01:00
tipc	tipc: Check the bearer type before calling tipc_udp_nl_bearer_add()	2024-02-16 19:10:50 +01:00
tls	tls: get psock ref after taking rxlock to avoid leak	2024-04-10 16:35:43 +02:00
unix	af_unix: Annotate data-race of gc_in_progress in wait_for_unix_gc().	2024-03-26 18:19:23 -04:00
vmw_vsock	vsock/virtio: fix packet delivery to tap device	2024-04-10 16:35:50 +02:00
wireless	wifi: cfg80211: add a flag to disable wireless extensions	2024-04-03 15:28:54 +02:00
x25	net/x25: fix incorrect parameter validation in the x25_getsockopt() function	2024-03-26 18:19:41 -04:00
xdp	xsk: Add truesize to skb_add_rx_frag().	2024-03-01 13:35:05 +01:00
xfrm	xfrm: Avoid clang fortify warning in copy_to_user_tmpl()	2024-04-03 15:28:40 +02:00
compat.c
devres.c
Kconfig
Kconfig.debug
Makefile
socket.c	net: Save and restore msg_namelen in sock_sendmsg	2024-01-10 17:16:51 +01:00
sysctl_net.c	sysctl: Add size to register_net_sysctl function	2023-08-15 15:26:17 -07:00