linux/net
Hyunwoo Kim ca4fb6c676 tcp: Fix Use-After-Free in tcp_ao_connect_init
[ Upstream commit 80e679b352 ]

Since call_rcu, which is called in the hlist_for_each_entry_rcu traversal
of tcp_ao_connect_init, is not part of the RCU read critical section, it
is possible that the RCU grace period will pass during the traversal and
the key will be free.

To prevent this, it should be changed to hlist_for_each_entry_safe.

Fixes: 7c2ffaf21b ("net/tcp: Calculate TCP-AO traffic keys")
Signed-off-by: Hyunwoo Kim <v4bel@theori.io>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Acked-by: Dmitry Safonov <0x7f454c46@gmail.com>
Link: https://lore.kernel.org/r/ZiYu9NJ/ClR8uSkH@v4bel-B760M-AORUS-ELITE-AX
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2024-05-02 16:35:17 +02:00
..
6lowpan net: fill in MODULE_DESCRIPTION()s for 6LoWPAN 2024-02-09 14:12:01 -08:00
9p 9p: Fix read/write debug statements to report server reply 2024-04-10 16:38:09 +02:00
802 net: fill in MODULE_DESCRIPTION()s under net/802* 2023-10-28 11:29:28 +01:00
8021q vlan: skip nested type that is not IFLA_VLAN_QOS_MAPPING 2024-01-19 21:25:06 -08:00
appletalk net: remove SOCK_DEBUG leftovers 2023-12-26 20:31:01 +00:00
atm net: fill in MODULE_DESCRIPTION()s for mpoa 2024-02-09 14:12:01 -08:00
ax25 ax25: Fix netdev refcount issue 2024-05-02 16:35:16 +02:00
batman-adv batman-adv: Avoid infinite loop trying to resize local TT 2024-04-17 11:23:24 +02:00
bluetooth Bluetooth: l2cap: Don't double set the HCI_CONN_MGMT_CONNECTED bit 2024-04-17 11:23:32 +02:00
bpf bpf: Fix dtor CFI 2023-12-15 16:25:55 -08:00
bridge bridge/br_netlink.c: no need to return void function 2024-05-02 16:35:15 +02:00
caif net: fill in MODULE_DESCRIPTION()s for CAIF 2024-01-05 08:06:35 -08:00
can can: j1939: Fix UAF in j1939_sk_match_filter during setsockopt(SO_J1939_FILTER) 2024-02-14 13:53:03 +01:00
ceph libceph: init the cursor when preparing sparse read in msgr2 2024-03-06 12:43:01 +01:00
core net: make SK_MEMORY_PCPU_RESERV tunable 2024-05-02 16:35:17 +02:00
dcb
dccp net: remove SOCK_DEBUG leftovers 2023-12-26 20:31:01 +00:00
devlink devlink: fix port new reply cmd type 2024-03-26 18:17:36 -04:00
dns_resolver Networking changes for 6.8. 2024-01-11 10:07:29 -08:00
dsa net: dsa: fix netdev_priv() dereference before check on non-DSA netdevice events 2024-01-11 16:33:52 -08:00
ethernet
ethtool ethtool: netlink: Add missing ethnl_ops_begin/complete 2024-01-18 13:21:06 +01:00
handshake net/handshake: Fix handshake_req_destroy_test1 2024-02-08 18:32:29 -08:00
hsr net: hsr: hsr_slave: Fix the promiscuous mode in offload mode 2024-04-10 16:37:56 +02:00
ieee802154 mac802154: Avoid new associations while disassociating 2023-12-15 11:14:57 +01:00
ife net: sched: ife: fix potential use-after-free 2023-12-15 10:50:18 +00:00
ipv4 tcp: Fix Use-After-Free in tcp_ao_connect_init 2024-05-02 16:35:17 +02:00
ipv6 netfilter: complete validation of user input 2024-04-17 11:23:32 +02:00
iucv net/iucv: fix the allocation size of iucv_path_table array 2024-02-16 09:25:09 +00:00
kcm net: kcm: fix incorrect parameter validation in the kcm_getsockopt) function 2024-03-26 18:16:57 -04:00
key net: fill in MODULE_DESCRIPTION()s for af_key 2024-02-09 14:12:01 -08:00
l2tp l2tp: fix incorrect parameter validation in the pppol2tp_getsockopt() function 2024-03-26 18:16:57 -04:00
l3mdev
lapb
llc llc: call sock_orphan() at release time 2024-01-30 13:49:09 +01:00
mac80211 wifi: mac80211: fix unaligned le16 access 2024-05-02 16:35:14 +02:00
mac802154 mac802154: fix llsec key resources release in mac802154_llsec_key_del 2024-04-03 15:32:15 +02:00
mctp net: mctp: copy skb ext data when fragmenting 2024-03-26 18:16:49 -04:00
mpls net: mpls: error out if inner headers are not set 2024-04-13 13:10:12 +02:00
mptcp mptcp: don't account accept() of non-MPC client as fallback to TCP 2024-04-10 16:38:09 +02:00
ncsi net/ncsi: Add NC-SI 1.2 Get MC MAC Address command 2023-11-18 15:00:51 +00:00
netfilter netfilter: nf_tables: fix memleak in map from abort path 2024-04-27 17:12:52 +02:00
netlabel calipso: fix memory leak in netlbl_calipso_add_pass() 2023-12-07 14:23:12 -05:00
netlink netlink: Fix kernel-infoleak-after-free in __skb_datagram_iter 2024-02-22 18:56:09 -08:00
netrom netrom: Fix data-races around sysctl_net_busy_read 2024-03-07 10:36:58 +01:00
nfc nfc: nci: Fix uninit-value in nci_dev_up and nci_ntf_packet 2024-04-10 16:37:54 +02:00
nsh
openvswitch net: openvswitch: fix unwanted error log on timeout policy probing 2024-04-17 11:23:28 +02:00
packet packet: annotate data-races around ignore_outgoing 2024-03-26 18:17:34 -04:00
phonet phonet/pep: fix racy skb_queue_empty() use 2024-02-22 09:05:50 +01:00
psample genetlink: Use internal flags for multicast groups 2023-12-29 08:43:59 +00:00
qrtr net: qrtr: ns: Return 0 if server port is not present 2024-01-01 18:41:29 +00:00
rds net/rds: fix possible cp null dereference 2024-04-10 16:38:02 +02:00
rfkill Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2023-12-21 22:17:23 +01:00
rose net/rose: fix races in rose_kill_by_device() 2023-12-15 11:59:53 +00:00
rxrpc rxrpc: Fix counting of new acks and nacks 2024-02-05 12:34:07 +00:00
sched net/sched: Fix mirred deadlock on device recursion 2024-04-27 17:12:53 +02:00
sctp net: sctp: fix skb leak in sctp_inq_free() 2024-02-15 07:34:52 -08:00
smc net/smc: reduce rtnl pressure in smc_pnet_create_pnetids_list() 2024-04-13 13:10:02 +02:00
strparser
sunrpc SUNRPC: Fix a slow server-side memory leak with RPC-over-TCP 2024-04-10 16:38:14 +02:00
switchdev net: bridge: switchdev: Skip MDB replays of deferred events on offload 2024-02-16 09:36:37 +00:00
tipc tipc: Check the bearer type before calling tipc_udp_nl_bearer_add() 2024-02-06 08:49:26 +01:00
tls tls: get psock ref after taking rxlock to avoid leak 2024-04-10 16:37:57 +02:00
unix af_unix: Don't peek OOB data without MSG_OOB. 2024-04-27 17:12:50 +02:00
vmw_vsock vsock/virtio: fix packet delivery to tap device 2024-04-10 16:38:03 +02:00
wireless wifi: cfg80211: check A-MSDU format more carefully 2024-04-13 13:10:01 +02:00
x25 net/x25: fix incorrect parameter validation in the x25_getsockopt() function 2024-03-26 18:16:57 -04:00
xdp xsk: validate user input for XDP_{UMEM|COMPLETION}_FILL_RING 2024-04-17 11:23:28 +02:00
xfrm xfrm: Allow UDP encapsulation only in offload modes 2024-03-26 18:17:34 -04:00
compat.c file: stop exposing receive_fd_user() 2023-12-12 14:24:14 +01:00
devres.c
Kconfig bpfilter: remove bpfilter 2024-01-04 10:23:10 -08:00
Kconfig.debug
Makefile bpfilter: remove bpfilter 2024-01-04 10:23:10 -08:00
socket.c vfs-6.8.iov_iter 2024-01-08 11:43:04 -08:00
sysctl_net.c