Wen Gu 0558226ceb net/smc: Fix slab-out-of-bounds issue in fallback ... syzbot reported a slab-out-of-bounds/use-after-free issue, which was caused by accessing an already freed smc sock in fallback-specific callback functions of clcsock. This patch fixes the issue by restoring fallback-specific callback functions to original ones and resetting clcsock sk_user_data to NULL before freeing smc sock. Meanwhile, this patch introduces sk_callback_lock to make the access and assignment to sk_user_data mutually exclusive. Reported-by: syzbot+b425899ed22c6943e00b@syzkaller.appspotmail.com Fixes: 341adeec9a ("net/smc: Forward wakeup to smc socket waitqueue after fallback") Link: https://lore.kernel.org/r/00000000000013ca8105d7ae3ada@google.com/ Signed-off-by: Wen Gu <guwen@linux.alibaba.com> Acked-by: Karsten Graul <kgraul@linux.ibm.com> Signed-off-by: Jakub Kicinski <kuba@kernel.org>		2022-04-25 11:03:48 -07:00
..
6lowpan	net: don't include ndisc.h from ipv6.h	2022-02-04 14:15:11 -08:00
9p	xen/grant-table: remove readonly parameter from functions	2022-03-15 20:34:40 -05:00
802
8021q	vlan: use correct format characters	2022-03-17 16:34:49 -07:00
appletalk
atm	proc: remove PDE_DATA() completely	2022-01-22 08:33:37 +02:00
ax25	ax25: Fix UAF bugs in ax25 timers	2022-03-29 10:24:34 +02:00
batman-adv	batman-adv: Use netif_rx().	2022-03-07 11:40:41 +00:00
bluetooth	Bluetooth: call hci_le_conn_failed with hdev lock in hci_le_conn_failed	2022-03-18 17:12:08 +01:00
bpf	bpf, test_run: Fix packet size check for live packet mode	2022-03-11 22:01:26 +01:00
bpfilter	uaccess: remove CONFIG_SET_FS	2022-02-25 09:36:06 +01:00
bridge	net: bridge: switchdev: check br_vlan_group() return value	2022-04-22 15:12:18 -07:00
caif	net: caif: Use netif_rx().	2022-03-04 12:02:19 +00:00
can	can: isotp: stop timeout monitoring when no first frame was sent	2022-04-17 17:21:22 +02:00
ceph	libceph: drop else branches in prepare_read_data{,_cont}	2022-03-01 18:26:36 +01:00
core	rtnetlink: Fix handling of disabled L3 stats in RTM_GETSTATS replies	2022-04-14 09:01:26 +02:00
dcb	net: dcb: disable softirqs in dcbnl_flush_dev()	2022-03-03 08:01:55 -08:00
dccp	dccp: remove max48()	2022-01-27 13:53:27 +00:00
decnet	net: decnet: use time_is_before_jiffies() instead of open coding it	2022-02-28 13:21:32 +00:00
dns_resolver
dsa	net: dsa: flood multicast to CPU when slave has IFF_PROMISC	2022-04-25 11:46:24 +01:00
ethernet
ethtool	ethtool: add support to set/get completion queue event size	2022-02-23 20:33:05 -08:00
hsr	net: add per-cpu storage and net->core_stats	2022-03-11 23:17:24 -08:00
ieee802154	net: ipv6: Handle delivery_time in ipv6 defrag	2022-03-03 14:38:48 +00:00
ife
ipv4	tcp: make sure treq->af_specific is initialized	2022-04-25 12:10:11 +01:00
ipv6	tcp: make sure treq->af_specific is initialized	2022-04-25 12:10:11 +01:00
iucv	s390/iucv: sort out physical vs virtual pointers usage	2022-02-22 16:09:13 -08:00
kcm
key	af_key: add __GFP_ZERO flag for compose_sadb_supported in function pfkey_register	2022-03-10 07:39:47 +01:00
l2tp
l3mdev	l3mdev: l3mdev_master_upper_ifindex_by_index_rcu should be using netdev_master_upper_dev_get_rcu	2022-04-15 14:27:24 -07:00
lapb
llc	llc: only change llc->dev when bind() succeeds	2022-03-25 16:55:41 -07:00
mac80211	mac80211: fix ht_capa printout in debugfs	2022-04-11 11:57:27 +02:00
mac802154
mctp	mctp: Use output netdev to allocate skb headroom	2022-04-01 12:04:15 +01:00
mpls	net: mpls: Fix GCC 12 warning	2022-02-10 15:29:39 +00:00
mptcp	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2022-03-23 10:53:49 -07:00
ncsi	all: replace find_next{,_zero}_bit with find_first{,_zero}_bit where appropriate	2022-01-15 08:47:31 -08:00
netfilter	netfilter: nft_set_rbtree: overlap detection with element re-addition after deletion	2022-04-22 15:49:15 +02:00
netlabel	netlabel: fix out-of-bounds memory accesses	2022-03-21 10:59:11 +00:00
netlink	netlink: reset network and mac headers in netlink_dump()	2022-04-19 15:05:03 +02:00
netrom	netrom: fix api breakage in nr_setsockopt()	2022-01-07 14:11:05 +00:00
nfc	nfc: nci: add flush_workqueue to prevent uaf	2022-04-13 14:44:44 +01:00
nsh
openvswitch	openvswitch: fix OOB access in reserve_sfa_size()	2022-04-15 11:50:02 +01:00
packet	net/packet: fix packet_sock xmit return value checking	2022-04-15 11:17:30 +01:00
phonet	phonet: Use netif_rx().	2022-03-07 11:40:41 +00:00
psample
qrtr
rds
rfkill	rfkill: make new event layout opt-in	2022-03-18 13:09:17 +02:00
rose
rxrpc	rxrpc: Restore removed timer deletion	2022-04-15 10:54:49 +01:00
sched	net/sched: cls_u32: fix possible leak in u32_init_knode()	2022-04-15 14:26:11 -07:00
sctp	sctp: check asoc strreset_chunk in sctp_generate_reconf_event	2022-04-23 22:34:17 +01:00
smc	net/smc: Fix slab-out-of-bounds issue in fallback	2022-04-25 11:03:48 -07:00
strparser
sunrpc	NFSD bug fixes for 5.18-rc:	2022-04-12 14:23:19 -10:00
switchdev	net: switchdev: remove lag_mod_cb from switchdev_handle_fdb_event_to_device	2022-02-24 21:31:43 -08:00
tipc	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2022-03-23 10:53:49 -07:00
tls	net/tls: fix slab-out-of-bounds bug in decrypt_internal	2022-04-01 11:53:35 +01:00
unix	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2022-03-23 10:53:49 -07:00
vmw_vsock	vsock/virtio: enable VQs early on probe	2022-03-24 18:36:36 -07:00
wireless	cfg80211: hold bss_lock while updating nontrans_list	2022-04-11 11:55:36 +02:00
x25	net/x25: Fix null-ptr-deref caused by x25_disconnect	2022-03-26 11:48:16 -07:00
xdp	xsk: Do not write NULL in SW ring at allocation failure	2022-03-28 19:56:28 -07:00
xfrm	xfrm: Pass flowi_oif or l3mdev as oif to xfrm_dst_lookup	2022-04-04 13:32:56 +02:00
compat.c
devres.c
Kconfig	page_pool: Add allocation stats	2022-03-03 09:55:28 +00:00
Kconfig.debug
Makefile
socket.c	fs: allocate inode by using alloc_inode_sb()	2022-03-22 15:57:03 -07:00
sysctl_net.c