Eric Dumazet
2d3c6a3ed3
BACKPORT: net: fix __dst_negative_advice() race ...
__dst_negative_advice() does not enforce proper RCU rules when
sk->dst_cache must be cleared, leading to possible UAF.
RCU rules are that we must first clear sk->sk_dst_cache,
then call dst_release(old_dst).
Note that sk_dst_reset(sk) is implementing this protocol correctly,
while __dst_negative_advice() uses the wrong order.
Given that ip6_negative_advice() has special logic
against RTF_CACHE, this means each of the three ->negative_advice()
existing methods must perform the sk_dst_reset() themselves.
Note the check against NULL dst is centralized in
__dst_negative_advice(), there is no need to duplicate
it in various callbacks.
Many thanks to Clement Lecigne for tracking this issue.
This old bug became visible after the blamed commit, using UDP sockets.
Bug: 343727534
Fixes: a87cb3e48ehttps://lore.kernel.org/r/20240528114353.1794151-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
(cherry picked from commit 92f1655aa2b2294d0b49925f3b875a634bd3b59e)
[Lee: Trivial/unrelated conflict - no change to the patch]
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: I293734dca1b81fcb712e1de294f51e96a405f7e4
[mkbestas: Non trivial backport to 4.9]
Signed-off-by: Michael Bestas <mkbestas@lineageos.org>
2024-08-19 10:13:09 +03:00
Bluetooth: L2CAP: Fix use-after-free caused by l2cap_chan_put
2022-08-25 11:09:20 +02:00
net: caif: add proper error handling
2021-06-10 12:42:36 +02:00
Merge remote-tracking branch 'common/android-4.9-q' into android12-4.9-sdm845
2022-03-31 22:52:51 +03:00
ANDROID: namespace'ify tcp_default_init_rwnd implementation
2020-10-19 16:29:06 -07:00
NFC: add NCI_UNREG flag to eliminate the race
2021-12-08 08:45:04 +01:00
phonet: fix building with clang
2019-03-23 13:19:44 +01:00
sctp: validate from_addr_param return
2021-09-26 13:36:19 +02:00
net/sched: act_tunnel_key: fix NULL dereference when 'goto chain' is used
2018-08-24 13:12:37 +02:00
6lowpan: add 802.15.4 short addr slaac
2016-06-15 20:41:22 -07:00
net sched: fix reporting the first-time use timestamp
2020-06-03 08:16:25 +02:00
This is the 4.9.233 stable release
2020-08-21 11:48:51 +02:00
rxrpc: Rewrite the data and ack handling code
2016-09-08 11:10:12 +01:00
af_unix: Suppress false-positive lockdep splat for spin_lock() in __unix_gc().
2024-07-21 16:03:38 -07:00
vsock: split dwork to avoid reinitializations
2018-08-22 07:47:13 +02:00
ipv4: Define __ipv4_neigh_lookup_noref when CONFIG_INET is disabled
2019-06-11 12:22:49 +02:00
ax25: fix possible use-after-free
2019-02-23 09:05:59 +01:00
bonding: 3ad: apply ad_actor settings changes immediately
2016-02-09 04:45:49 -05:00
bonding: wait for sysfs kobject destruction before freeing struct slave
2020-12-11 13:37:57 +01:00
net: Fix a data-race around sysctl_net_busy_poll.
2022-09-05 10:23:55 +02:00
calipso: Add a label cache.
2016-06-27 15:06:17 -04:00
Merge branch 'android-4.9-q' of https://android.googlesource.com/kernel/common into lineage-18.1-caf-sdm845
2021-07-22 02:11:11 +03:00
ieee802154: add netns support
2016-07-08 12:20:57 +02:00
openvswitch: Fix setting ipv6 fields causing hw csum failure
2022-03-02 11:32:02 +01:00
netlabel: out of bound access in cipso_v4_validate()
2017-02-18 15:11:41 +01:00
cls_cgroup: get sk_classid only from full sockets
2016-04-19 20:09:25 -04:00
Merge "cnss: Add support for PCIe WLAN IPA uc SMMU feature"
2018-07-26 07:45:06 -07:00
cnss2: Sync code from kernel 4.14
2020-05-17 20:19:19 -07:00
cnss: Add support of cnss driver
2018-02-08 16:32:00 +08:00
cnss_nl: Add new attributes for cld80211 attr list
2020-03-07 00:19:25 +05:30
wcnss: Fix buffer overflow in wcnss_prealloc_get
2018-09-12 16:05:33 +05:30
cnss_utils: Add support for derived MAC address
2017-11-09 15:08:16 -08:00
codel: split into multiple files
2016-04-25 16:44:27 -04:00
codel: split into multiple files
2016-04-25 16:44:27 -04:00
net_sched: fq_codel: cache skb->truesize into skb->cb
2016-06-25 12:19:35 -04:00
packet: compat support for sock_fprog
2016-06-09 23:41:03 -07:00
devlink: remove unused priv_size
2016-08-26 11:55:18 -07:00
net: dsa: add port fast ageing
2016-09-23 08:38:50 -04:00
net: Added pointer check for dst->ops->neigh_lookup in dst_neigh_lookup_skb
2020-07-22 09:10:48 +02:00
net: add dst_cache support
2016-02-16 20:21:48 -05:00
net: fix a memleak when uncloning an skb dst and its metadata
2022-02-16 12:43:54 +01:00
BACKPORT: net: fix __dst_negative_advice() race
2024-08-19 10:13:09 +03:00
This is the 4.9.217 stable release
2020-03-20 11:01:08 +01:00
UPSTREAM: flow: Extend flow informations with xfrm interface id.
2018-10-26 21:39:51 -07:00
net: sched: correct flower port blocking
2020-03-11 07:53:05 +01:00
fou: Add encap ops for IPv6 tunnels
2016-05-20 18:03:16 -04:00
net/flow_dissector: switch to siphash
2019-11-10 11:23:31 +01:00
net/flow_dissector: switch to siphash
2019-11-10 11:23:31 +01:00
net: sched: do not acquire qdisc spinlock in qdisc/class stats dump
2016-06-07 16:37:14 -07:00
genetlink: remove genl_bind
2020-07-22 09:10:48 +02:00
net: Remove deprecated tunnel specific UDP offload functions
2016-06-17 20:23:32 -07:00
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
2016-08-18 01:17:32 -04:00
gro_cells: make sure device is up in gro_cells_receive()
2019-03-19 13:14:10 +01:00
gtp: #define #define _GTP_H_ and not #define _GTP_H
2016-07-25 17:55:43 -07:00
net: add a hardware buffer management helper API
2016-03-14 12:19:46 -04:00
net: icmp: pass zeroed opts from icmp{,v6}_ndo_send before sending
2021-03-03 17:44:46 +01:00
mac80211: add support for radiotap timestamp field
2016-09-12 11:45:45 +02:00
net: ieee802154: return -EINVAL for unknown addr type
2022-10-26 13:15:48 +02:00
BACKPORT: ipv6: Implement draft-ietf-6man-rfc4941bis
2022-01-31 14:39:14 +00:00
ipv6: remove unused in6_addr struct
2016-03-22 15:45:44 -04:00
tcp/dccp: do not touch listener sk_refcnt under synflood
2016-04-04 22:11:20 -04:00
ip4ip6: Support for GSO/GRO
2016-05-20 18:03:17 -04:00
net: refactor bind_bucket fastreuse into helper
2020-09-12 11:47:38 +02:00
vlan: consolidate VLAN parsing code and limit max parsing depth
2020-12-11 13:37:58 +01:00
net: IP defrag: encapsulate rbtree defrag code into callable functions
2019-05-02 09:32:06 +02:00
secure_seq: use the 64 bits of the siphash for port offset calculation
2022-06-25 11:45:19 +02:00
This is the 4.9.325 stable release
2022-07-29 18:58:19 +02:00
soreuseport: initialise timewait reuseport field
2018-05-16 10:08:41 +02:00
net: ipv4: use a dedicated counter for icmp_v4 redirect packets
2019-02-23 09:05:59 +01:00
Merge remote-tracking branch 'common/android-4.9-q' into android12-4.9-sdm845
2022-09-06 06:20:26 +03:00
ipv6: Pass proto to csum_ipv6_magic as __u8 instead of unsigned short
2016-03-13 23:55:13 -04:00
ipv6: fix sparse warning on rt6i_node
2017-09-20 08:19:53 +02:00
This is the 4.9.277 stable release
2021-07-28 12:36:41 +02:00
ip6_tunnel: allow not to count pkts on tstats by passing dev as NULL
2019-07-21 09:05:57 +02:00
net: ipv4: Fix memory leak in network namespace dismantle
2019-01-31 08:12:33 +01:00
ip_tunnel: add collect_md mode to IPIP tunnel
2016-09-17 10:13:07 -04:00
ipvs: move old_secure_tcp into struct netns_ipvs
2019-11-12 19:15:57 +01:00
net: ipv6: add net argument to ip6_dst_lookup_flow
2020-05-20 08:15:30 +02:00
ip6: fix skb leak in ip6frag_expire_frag_queue()
2019-09-16 08:19:33 +02:00
wext: handle NULL extra data in iwe_stream_add_point better
2017-08-11 08:49:34 -07:00
kcm: Use stream parser
2016-08-17 19:36:23 -04:00
ipvlan, l3mdev: fix broken l3s mode wrt local routes
2019-02-06 17:33:27 +01:00
llc: fix out-of-bound array index in llc_sk_dev_hash()
2021-11-26 11:48:39 +01:00
llc: fix sk_buff leak in llc_conn_service()
2019-11-06 12:18:24 +01:00
net: llc: fix skb_over_panic
2021-08-04 11:58:03 +02:00
lwtunnel: valid encap attr check should return 0 when lwtunnel is disabled
2017-02-18 15:11:42 +01:00
mac80211: round IEEE80211_TX_STATUS_HEADROOM up to multiple of 4
2018-05-30 07:50:28 +02:00
ieee802154: cleanup WARN_ON for fc fetch
2016-07-08 13:23:12 +02:00
openvswitch: use mpls_hdr
2016-10-03 02:00:22 -04:00
mrp: introduce active flags to prevent UAF when applicant uninit
2023-01-07 12:07:32 +01:00
net/ncsi: Introduce ncsi_stop_dev()
2016-10-04 02:11:51 -04:00
UPSTREAM: ipv6: ndisc: RFC-ietf-6man-ra-pref64-09 is now published as RFC8781
2020-11-16 14:33:43 +01:00
Merge android-4.9.209(c830063) into msm-4.9
2020-03-13 15:47:19 +08:00
netns: provide pure entropy for net_hash_mix()
2019-04-17 08:36:46 +02:00
neigh: Send a notification when DELAY_PROBE_TIME changes
2016-07-05 09:06:29 -07:00
netlabel: Implement CALIPSO config functions for SMACK.
2016-06-27 15:06:18 -04:00
netlink: fix nla_put_{u8,u16,u32} for KASAN
2017-10-12 11:51:25 +02:00
net: fix rtnh_ok()
2018-05-16 10:08:41 +02:00
net: ieee802154: handle iftypes as u32
2021-12-08 08:45:03 +01:00
net: ping: make ping_v6_sendmsg static
2016-03-23 22:09:58 -04:00
net/sched: pkt_cls: change tc actions order to be as the user sets
2016-09-28 05:02:44 -04:00
net_sched: Add flow control support to prio qdisc
2017-03-22 17:37:14 -06:00
pptp: Refactor the struct and macros of PPTP codes
2016-08-15 10:55:53 -07:00
udp: Remove udp_offloads
2016-04-07 16:53:30 -04:00
sock: struct proto hash function may error
2016-02-11 03:54:14 -05:00
sch_red: fix off-by-one checks in red_check_params()
2021-04-16 11:59:07 +02:00
regulatory: add NUL to request alpha2
2018-05-30 07:50:30 +02:00
inet: reqsk_alloc() needs to take care of dead listeners
2016-04-04 22:11:19 -04:00
net: rmnet_data: Add snapshot of rmnet_data driver
2016-11-01 20:02:26 -06:00
This is the 4.9.104 stable release
2018-05-30 13:19:56 +02:00
can: dev: Move device back to init netns on owning netns delete
2021-03-30 14:41:42 +02:00
net_sched: restore "mpu xxx" handling
2022-01-27 08:47:42 +01:00
unix: correctly track in-flight fds in sending process user_struct
2016-02-08 10:30:42 -05:00
secure_seq: use the 64 bits of the siphash for port offset calculation
2022-06-25 11:45:19 +02:00
slip: Check if rstate is initialized before uncompressing
2018-04-20 08:21:07 +02:00
net: snmp: fix 64bit stats on 32bit arches
2016-04-28 11:49:45 -04:00
BACKPORT: net: fix __dst_negative_advice() race
2024-08-19 10:13:09 +03:00
soreuseport: fix NULL ptr dereference SO_REUSEPORT after bind
2016-01-19 14:44:23 -05:00
kcm: Remove TCP specific references from kcm and strparser
2016-08-28 23:32:41 -04:00
switchdev: remove FIB offload infrastructure
2016-09-28 04:48:00 -04:00
Merge remote-tracking branch 'common/android-4.9-q' into android13-4.9-sdm845
2022-11-09 19:25:28 +02:00
ipv6: add new struct ipcm6_cookie
2016-05-03 16:08:14 -04:00
udp6: set rx_dst_cookie on rx_dst updates
2017-10-09 16:01:04 -06:00
vxlan: Add new UDP encapsulation offload type for VXLAN-GPE
2016-06-17 20:23:32 -07:00
udplite: fix partial checksum initialization
2018-03-11 16:21:32 +01:00
vxlan: fix hlist corruption
2017-07-21 07:42:18 +02:00
net: x25: fix one potential use-after-free issue
2018-04-13 19:48:00 +02:00
Merge remote-tracking branch 'common/android-4.9-q' into android12-4.9-sdm845
2022-06-12 01:39:01 +03:00
2d3c6a3ed3