Cong Wang aadb2bb83f sock_map: Fix a potential use-after-free in sock_map_close() ... The last refcnt of the psock can be gone right after sock_map_remove_links(), so sk_psock_stop() could trigger a UAF. The reason why I placed sk_psock_stop() there is to avoid RCU read critical section, and more importantly, some callee of sock_map_remove_links() is supposed to be called with RCU read lock, we can not simply get rid of RCU read lock here. Therefore, the only choice we have is to grab an additional refcnt with sk_psock_get() and put it back after sk_psock_stop(). Fixes: 799aa7f98d ("skmsg: Avoid lock_sock() in sk_psock_backlog()") Reported-by: syzbot+7b6548ae483d6f4c64ae@syzkaller.appspotmail.com Signed-off-by: Cong Wang <cong.wang@bytedance.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Acked-by: John Fastabend <john.fastabend@gmail.com> Acked-by: Jakub Sitnicki <jakub@cloudflare.com> Link: https://lore.kernel.org/bpf/20210408030556.45134-1-xiyou.wangcong@gmail.com		2021-04-12 17:35:26 +02:00
..
6lowpan	6lowpan: Fix some typos in nhc_udp.c	2021-03-24 17:52:11 -07:00
9p	net: 9p: Correct function names in the kerneldoc comments	2021-03-28 17:56:56 -07:00
802
8021q	net: bridge: resolve forwarding path for VLAN tag actions in bridge devices	2021-03-24 12:48:38 -07:00
appletalk	appletalk: Fix skb allocation size in loopback case	2021-02-12 16:40:28 -08:00
atm	net: atm: pppoatm: use new API for wakeup tasklet	2021-01-29 18:24:05 -08:00
ax25	net/ax25: Delete obsolete TODO file	2021-03-30 16:54:50 -07:00
batman-adv	mld: convert ifmcaddr6 to RCU	2021-03-26 15:14:56 -07:00
bluetooth	Merge branch 'for-upstream' of git://git.kernel.org/pub/scm/linux/kern	2021-02-11 14:59:01 -08:00
bpf	bpf: selftests: Add kfunc_call test	2021-03-26 20:41:52 -07:00
bpfilter	net: remove redundant 'depends on NET'	2021-01-27 17:04:12 -08:00
bridge	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2021-03-25 15:31:22 -07:00
caif	net: caif: Use netif_rx_any_context().	2021-02-15 13:21:48 -08:00
can	can: isotp: tx-path: zero initialize outgoing CAN frames	2021-03-20 20:21:35 +01:00
ceph	net: ceph: Fix a typo in osdmap.c	2021-03-25 17:05:07 -07:00
core	sock_map: Fix a potential use-after-free in sock_map_close()	2021-04-12 17:35:26 +02:00
dcb	net: dcb: use obj-$(CONFIG_DCB) form in net/Makefile	2021-01-27 17:03:52 -08:00
dccp	ipv6: weaken the v4mapped source check	2021-03-18 11:19:23 -07:00
decnet	net/decnet: Delete obsolete TODO file	2021-03-30 16:54:50 -07:00
dns_resolver	net: remove redundant 'depends on NET'	2021-01-27 17:04:12 -08:00
dsa	net: dsa: Fix a typo in tag_rtl4_a.c	2021-03-25 17:05:08 -07:00
ethernet	ethernet: avoid retpoline overhead on TEB (GENEVE, NvGRE, VxLAN) GRO	2021-03-18 19:51:12 -07:00
ethtool	ethtool: support FEC settings over netlink	2021-03-31 14:15:23 -07:00
hsr	/net/hsr: fix misspellings using codespell tool	2021-03-18 19:13:41 -07:00
ieee802154	treewide: rename nla_strlcpy to nla_strscpy.	2020-11-16 08:08:54 -08:00
ife	net: remove redundant 'depends on NET'	2021-01-27 17:04:12 -08:00
ipv4	skmsg: Pass psock pointer to ->psock_update_sk_prot()	2021-04-12 17:34:27 +02:00
ipv6	mptcp: add mptcp reset option support	2021-04-02 14:21:50 -07:00
iucv	iucv: af_iucv.c: Couple of typo fixes	2021-03-28 17:31:13 -07:00
kcm	kcm: kcmsock.c: Couple of typo fixes	2021-03-28 17:31:13 -07:00
key	af_key: relax availability checks for skb size calculation	2021-01-04 10:05:50 +01:00
l2tp	net: l2tp: Fix a typo	2021-03-22 13:17:49 -07:00
l3mdev	l3mdev: Correct function names in the kerneldoc comments	2021-03-28 17:56:55 -07:00
lapb	net: lapb: Make "lapb_t1timer_running" able to detect an already running timer	2021-03-23 14:14:50 -07:00
llc	llc: llc_core.c: COuple of typo fixes	2021-03-28 17:31:13 -07:00
mac80211	mac80211: cfg.c: A typo fix	2021-03-28 17:31:13 -07:00
mac802154	net: mac802154: convert tasklets to use new tasklet_setup() API	2020-11-07 10:40:56 -08:00
mpls	net: avoid infinite loop in mpls_gso_segment when mpls_hlen == 0	2021-03-09 16:12:20 -08:00
mptcp	mptcp: add mptcp reset option support	2021-04-02 14:21:50 -07:00
ncsi	ncsi: internal.h: Fix a spello	2021-03-28 17:31:13 -07:00
netfilter	netfilter: nf_conntrack_acct.c: A typo fix	2021-03-28 17:31:14 -07:00
netlabel	netlabel: Correct function name netlbl_mgmt_add() in the kerneldoc comments	2021-03-28 17:56:55 -07:00
netlink	mptcp: avoid lock_fast usage in accept path	2021-02-12 16:31:46 -08:00
netrom
nfc	NFC: digital: Correct function name in the kerneldoc comments	2021-03-28 17:56:56 -07:00
nsh
openvswitch	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2021-03-25 15:31:22 -07:00
packet	net/packet: Fix a typo in af_packet.c	2021-03-24 17:52:11 -07:00
phonet
psample	psample: Add additional metadata attributes	2021-03-14 15:00:43 -07:00
qrtr	qrtr: Convert qrtr_ports from IDR to XArray	2021-03-31 14:32:20 -07:00
rds	net: rds: Fix a typo	2021-03-28 17:52:50 -07:00
rfkill	rfkill: add a reason to the HW rfkill state	2020-12-11 12:47:17 +01:00
rose	net: rose: Fix fall-through warnings for Clang	2021-03-10 12:45:15 -08:00
rxrpc	rxrpc: Fix dependency on IPv6 in udp tunnel config	2021-02-12 16:42:05 -08:00
sched	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2021-03-25 15:31:22 -07:00
sctp	net: sctp: Fix some typos	2021-03-28 17:52:50 -07:00
smc	net: smc: Remove repeated struct declaration	2021-04-01 15:52:38 -07:00
strparser
sunrpc	Miscellaneous NFSD fixes for v5.12-rc.	2021-03-16 10:22:50 -07:00
switchdev	net: bridge: propagate extack through switchdev_port_attr_set	2021-02-14 17:38:11 -08:00
tipc	tipc: fix unique bearer names sanity check	2021-04-01 15:43:31 -07:00
tls	skmsg: Extract __tcp_bpf_recvmsg() and tcp_bpf_wait_data()	2021-04-01 10:56:14 -07:00
unix	af_unix: handle idmapped mounts	2021-01-24 14:27:18 +01:00
vmw_vsock	net: vsock: Fix a typo	2021-03-28 17:52:51 -07:00
wireless	reg.c: Fix a spello	2021-03-28 17:31:14 -07:00
x25	af_x25.c: Fix a spello	2021-03-28 17:31:13 -07:00
xdp	bpf, xdp: Restructure redirect actions	2021-03-10 01:06:34 +01:00
xfrm	xfrm_user.c: Added a punctuation	2021-03-28 17:31:14 -07:00
compat.c	iov_iter: transparently handle compat iovecs in import_iovec	2020-10-03 00:02:13 -04:00
devres.c
Kconfig	net: add CONFIG_PCPU_DEV_REFCNT	2021-03-19 13:38:46 -07:00
Makefile	net: l3mdev: use obj-$(CONFIG_NET_L3_MASTER_DEV) form in net/Makefile	2021-01-27 17:03:52 -08:00
socket.c	net: Fix a misspell in socket.c	2021-03-25 16:56:27 -07:00
sysctl_net.c