Eric Dumazet 4dcb07c90d ipv6: fix possible UAF in ip6_finish_output2() ... [ Upstream commit e891b36de161fcd96f12ff83667473e5067b9037 ] If skb_expand_head() returns NULL, skb has been freed and associated dst/idev could also have been freed. We need to hold rcu_read_lock() to make sure the dst and associated idev are alive. Fixes: 5796015fa968 ("ipv6: allocate enough headroom in ip6_finish_output2()") Signed-off-by: Eric Dumazet <edumazet@google.com> Cc: Vasily Averin <vasily.averin@linux.dev> Reviewed-by: David Ahern <dsahern@kernel.org> Link: https://patch.msgid.link/20240820160859.3786976-3-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org> (cherry picked from commit e891b36de161fcd96f12ff83667473e5067b9037) Signed-off-by: Harshvardhan Jha <harshvardhan.j.jha@oracle.com> Signed-off-by: Sasha Levin <sashal@kernel.org>		2025-01-15 16:29:51 +01:00
..
ila	ila: call nf_unregister_net_hooks() sooner	2024-11-23 23:21:00 +01:00
netfilter	Revert "inet: inet_defrag: prevent sk release while still in use"	2024-11-24 00:23:32 +01:00
addrconf.c	ipv6: take care of scope when choosing the src addr	2024-11-23 23:20:12 +01:00
addrconf_core.c	ipv6: Ensure natural alignment of const ipv6 loopback and router addresses	2024-11-18 12:13:22 +01:00
addrlabel.c
af_inet6.c	net: inet6: do not leave a dangling sk pointer in inet6_create()	2024-12-17 13:24:30 +01:00
ah6.c
anycast.c
calipso.c
datagram.c
esp6.c	Revert "net: esp: cleanup esp_output_tail_tcp() in case of unsupported ESPINTCP"	2024-11-24 00:23:57 +01:00
esp6_offload.c
exthdrs.c
exthdrs_core.c
exthdrs_offload.c
fib6_notifier.c
fib6_rules.c	ipv6: fib6_rules: avoid possible NULL dereference in fib6_rule_action()	2024-11-19 11:32:46 +01:00
fou6.c
icmp.c
inet6_connection_sock.c
inet6_hashtables.c	net: remove duplicate reuseport_lookup functions	2024-11-19 12:26:55 +01:00
ip6_checksum.c
ip6_fib.c	ipv6: fix possible race in __fib6_drop_pcpu_from()	2024-11-19 14:19:01 +01:00
ip6_flowlabel.c
ip6_gre.c	erspan: make sure erspan_base_hdr is present in skb->head	2024-11-19 09:22:47 +01:00
ip6_icmp.c
ip6_input.c
ip6_offload.c	Revert "gro: remove rcu_read_lock/rcu_read_unlock from gro_receive handlers"	2024-11-24 00:23:41 +01:00
ip6_offload.h
ip6_output.c	ipv6: fix possible UAF in ip6_finish_output2()	2025-01-15 16:29:51 +01:00
ip6_tunnel.c	Revert "ip6_tunnel: Fix broken GRO"	2024-11-24 00:23:51 +01:00
ip6_udp_tunnel.c
ip6_vti.c
ip6mr.c	ipmr: convert /proc handlers to rcu_read_lock()	2024-12-17 13:24:16 +01:00
ipcomp6.c
ipv6_sockglue.c	tcp: Fix data races around icsk->icsk_af_ops.	2024-11-19 14:19:35 +01:00
Kconfig	Revert "net: ipv6: select DST_CACHE from IPV6_RPL_LWTUNNEL"	2024-11-24 00:23:18 +01:00
Makefile
mcast.c
mcast_snoop.c
mip6.c
ndisc.c	Revert "ipv6: fix ndisc_is_useropt() handling for PIO"	2024-11-24 00:23:55 +01:00
netfilter.c
output_core.c
ping.c
proc.c
protocol.c
raw.c
reassembly.c	net: ipv6: fix wrong start position when receive hop-by-hop fragment	2024-11-19 12:26:56 +01:00
route.c	net/ipv6: release expired exception dst cached in socket	2024-12-17 13:24:26 +01:00
rpl.c
rpl_iptunnel.c	Revert "net: ipv6: rpl_iptunnel: Fix memory leak in rpl_input"	2024-11-24 00:23:29 +01:00
seg6.c	ipv6: sr: fix invalid unregister error path	2024-11-19 12:26:57 +01:00
seg6_hmac.c	ipv6: sr: fix memleak in seg6_hmac_init_algo	2024-11-19 12:27:09 +01:00
seg6_iptunnel.c	ipv6: sr: block BH in seg6_output_core() and seg6_input_core()	2024-11-19 14:19:00 +01:00
seg6_local.c	Revert "net: seg6: fix seg6_lookup_any_nexthop() to handle VRFs using flowi_l3mdev"	2024-11-24 00:22:54 +01:00
sit.c
syncookies.c
sysctl_net_ipv6.c	Revert "Make more sysctl constants read-only"	2024-12-03 19:56:17 +01:00
tcp_ipv6.c	Revert "tcp: add accessors to read/set tp->snd_cwnd"	2024-12-18 15:30:18 +01:00
tcpv6_offload.c
tunnel6.c
udp.c	udp: Avoid call to compute_score on multiple sites	2024-11-19 12:26:55 +01:00
udp_impl.h
udp_offload.c	Revert "gro: remove rcu_read_lock/rcu_read_unlock from gro_receive handlers"	2024-11-24 00:23:41 +01:00
udplite.c
xfrm6_input.c	xfrm: Preserve vlan tags for transport mode software GRO	2024-11-19 11:32:45 +01:00
xfrm6_output.c
xfrm6_policy.c	xfrm: respect ip protocols rules criteria when performing dst lookups	2024-11-23 23:22:00 +01:00
xfrm6_protocol.c
xfrm6_state.c
xfrm6_tunnel.c