linux/net
Florian Westphal 50cbb9d195 netfilter: nft_set_rbtree: fix overlap expiration walk
[ Upstream commit f718863aca ]

The lazy gc on insert that should remove timed-out entries fails to release
the other half of the interval, if any.

Can be reproduced with tests/shell/testcases/sets/0044interval_overlap_0
in nftables.git and kmemleak enabled kernel.

Second bug is the use of rbe_prev vs. prev pointer.
If rbe_prev() returns NULL after at least one iteration, rbe_prev points
to element that is not an end interval, hence it should not be removed.

Lastly, check the genmask of the end interval if this is active in the
current generation.

Fixes: c9e6978e27 ("netfilter: nft_set_rbtree: Switch to node list walk for overlap detection")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-08-03 10:22:36 +02:00
..
6lowpan
9p 9p/xen : Fix use after free bug in xen_9pfs_front_remove due to race condition 2023-04-20 12:13:53 +02:00
802 mrp: introduce active flags to prevent UAF when applicant uninit 2022-12-31 13:14:42 +01:00
8021q vlan: fix a potential uninit-value in vlan_dev_hard_start_xmit() 2023-05-24 17:36:52 +01:00
appletalk
atm atm: hide unused procfs functions 2023-06-09 10:32:26 +02:00
ax25 net: ax25: Fix deadlock caused by skb_recv_datagram in ax25_recvmsg 2022-06-22 14:22:01 +02:00
batman-adv batman-adv: Broken sync while rescheduling delayed work 2023-06-14 11:13:04 +02:00
bluetooth Bluetooth: Fix use-after-free in hci_remove_ltk/hci_remove_irk 2023-06-14 11:13:06 +02:00
bpf bpf: Move skb->len == 0 checks into __bpf_redirect 2022-12-31 13:14:11 +01:00
bpfilter
bridge bridge: Add extack warning when enabling STP in netns. 2023-07-27 08:46:59 +02:00
caif net: caif: Fix use-after-free in cfusbl_device_notify() 2023-03-17 08:48:54 +01:00
can can: bcm: Fix UAF in bcm_proc_show() 2023-07-27 08:46:55 +02:00
ceph libceph: harden msgr2.1 frame segment length checks 2023-07-23 13:47:53 +02:00
core of: net: add a helper for loading netdev->dev_addr 2023-07-27 08:46:59 +02:00
dcb net: dcb: disable softirqs in dcbnl_flush_dev() 2022-03-08 19:12:52 +01:00
dccp dccp: Call inet6_destroy_sock() via sk->sk_destruct(). 2023-04-26 13:51:54 +02:00
dns_resolver
dsa net: dsa: tag_sja1105: fix MAC DA patching from meta frames 2023-07-23 13:47:30 +02:00
ethernet
ethtool ethtool: Fix uninitialized number of lanes 2023-05-17 11:50:18 +02:00
hsr hsr: ratelimit only when errors are printed 2023-04-05 11:25:02 +02:00
ieee802154 net: ieee802154: fix error return code in dgram_bind() 2022-11-03 23:59:14 +09:00
ife
ipv4 tcp: annotate data-races around fastopenq.max_qlen 2023-07-27 08:47:04 +02:00
ipv6 ipv6 addrconf: fix bug where deleting a mngtmpaddr can create a new temporary address 2023-08-03 10:22:34 +02:00
iucv net/iucv: Fix size of interrupt data 2023-03-22 13:31:28 +01:00
kcm kcm: close race conditions on sk_receive_queue 2022-11-26 09:24:50 +01:00
key af_key: Reject optional tunnel/BEET mode templates in outbound policies 2023-05-24 17:36:49 +01:00
l2tp inet6: Remove inet6_destroy_sock() in sk->sk_prot->destroy(). 2023-04-26 13:51:54 +02:00
l3mdev l3mdev: l3mdev_master_upper_ifindex_by_index_rcu should be using netdev_master_upper_dev_get_rcu 2022-04-27 14:38:53 +02:00
lapb
llc llc: Don't drop packet from non-root netns. 2023-07-27 08:47:02 +02:00
mac80211 wifi: mac80211: simplify chanctx allocation 2023-06-09 10:32:25 +02:00
mac802154 mac802154: fix missing INIT_LIST_HEAD in ieee802154_if_add() 2022-12-14 11:37:25 +01:00
mctp net: mctp: purge receive queues on sk destruction 2023-02-06 07:59:02 +01:00
mpls net: mpls: fix stale pointer if allocation fails during device rename 2023-02-22 12:57:09 +01:00
mptcp mptcp: consolidate fallback and non fallback state machine 2023-07-05 18:25:04 +01:00
ncsi net/ncsi: clear Tx enable mode when handling a Config required AEN 2023-05-17 11:50:16 +02:00
netfilter netfilter: nft_set_rbtree: fix overlap expiration walk 2023-08-03 10:22:36 +02:00
netlabel netlabel: fix out-of-bounds memory accesses 2022-04-13 20:59:10 +02:00
netlink netlink: Add __sock_i_ino() for __netlink_diag_dump(). 2023-07-23 13:46:56 +02:00
netrom netrom: fix info-leak in nr_write_internal() 2023-06-09 10:32:16 +02:00
nfc net: nfc: Fix use-after-free caused by nfc_llcp_find_local 2023-07-23 13:46:56 +02:00
nsh net: nsh: Use correct mac_offset to unwind gso skb in nsh_gso_segment() 2023-05-24 17:36:51 +01:00
openvswitch net: openvswitch: fix possible memory leak in ovs_meter_cmd_set() 2023-02-22 12:57:09 +01:00
packet af_packet: do not use READ_ONCE() in packet_bind() 2023-06-09 10:32:17 +02:00
phonet phonet: refcount leak in pep_sock_accep 2022-01-11 15:35:16 +01:00
psample
qrtr net: qrtr: Fix an uninit variable access bug in qrtr_tx_resume() 2023-04-20 12:13:53 +02:00
rds rds: rds_rm_zerocopy_callback() correct order for list_add_tail() 2023-03-10 09:39:16 +01:00
rfkill rfkill: make new event layout opt-in 2022-04-08 14:23:00 +02:00
rose net/rose: Fix to not accept on connected socket 2023-02-22 12:57:02 +01:00
rxrpc rxrpc: Fix hard call timeout units 2023-05-17 11:50:17 +02:00
sched net: sched: cls_bpf: Undo tcf_bind_filter in case of an error 2023-07-27 08:47:00 +02:00
sctp sctp: fix potential deadlock on &net->sctp.addr_wq_lock 2023-07-23 13:47:27 +02:00
smc net/smc: Avoid to access invalid RMBs' MRs in SMCRv1 ADD LINK CONT 2023-06-14 11:13:01 +02:00
strparser bpf: sockmap, strparser, and tls are reusing qdisc_skb_cb and colliding 2021-11-18 19:17:11 +01:00
sunrpc SUNRPC: Fix UAF in svc_tcp_listen_data_ready() 2023-07-23 13:47:20 +02:00
switchdev
tipc net: tipc: resize nlattr array to correct size 2023-06-21 15:59:18 +02:00
tls net: deal with most data-races in sk_wait_event() 2023-05-24 17:36:42 +01:00
unix af_unix: Fix data races around sk->sk_shutdown. 2023-05-24 17:36:42 +01:00
vmw_vsock vsock: avoid to close connected socket after the timeout 2023-05-24 17:36:49 +01:00
wireless wifi: cfg80211: rewrite merging of inherited elements 2023-07-23 13:46:53 +02:00
x25 net/x25: Fix to not accept on connected socket 2023-02-09 11:26:40 +01:00
xdp xsk: Honor SO_BINDTODEVICE on bind 2023-07-23 13:47:29 +02:00
xfrm xfrm: Ensure policies always checked on XFRM-I input path 2023-06-28 10:29:45 +02:00
compat.c
devres.c
Kconfig Remove DECnet support from kernel 2023-06-21 15:59:15 +02:00
Makefile Remove DECnet support from kernel 2023-06-21 15:59:15 +02:00
socket.c net: annotate sk->sk_err write from do_recvmmsg() 2023-05-24 17:36:42 +01:00
sysctl_net.c