Eric Dumazet 4dcb07c90d ipv6: fix possible UAF in ip6_finish_output2() ... [ Upstream commit e891b36de161fcd96f12ff83667473e5067b9037 ] If skb_expand_head() returns NULL, skb has been freed and associated dst/idev could also have been freed. We need to hold rcu_read_lock() to make sure the dst and associated idev are alive. Fixes: 5796015fa968 ("ipv6: allocate enough headroom in ip6_finish_output2()") Signed-off-by: Eric Dumazet <edumazet@google.com> Cc: Vasily Averin <vasily.averin@linux.dev> Reviewed-by: David Ahern <dsahern@kernel.org> Link: https://patch.msgid.link/20240820160859.3786976-3-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org> (cherry picked from commit e891b36de161fcd96f12ff83667473e5067b9037) Signed-off-by: Harshvardhan Jha <harshvardhan.j.jha@oracle.com> Signed-off-by: Sasha Levin <sashal@kernel.org>		2025-01-15 16:29:51 +01:00
..
6lowpan
9p	9p/xen: fix release of IRQ	2024-12-17 13:24:22 +01:00
802
8021q	Revert "gro: remove rcu_read_lock/rcu_read_unlock from gro_receive handlers"	2024-11-24 00:23:41 +01:00
appletalk
atm
ax25	Revert "Make more sysctl constants read-only"	2024-12-03 19:56:17 +01:00
batman-adv	batman-adv: Do not let TT changes list grows indefinitely	2025-01-02 17:00:49 +01:00
bluetooth	Bluetooth: L2CAP: do not leave dangling sk pointer on error in l2cap_sock_create()	2024-12-17 13:24:30 +01:00
bpf
bpfilter
bridge	net: bridge: xmit: make sure we have at least eth header len bytes	2024-11-30 02:33:25 +01:00
caif
can	net: af_can: do not leave a dangling sk pointer in can_create()	2024-12-17 13:24:30 +01:00
ceph	libceph: fix race between delayed_work() and ceph_monc_stop()	2024-11-19 14:19:45 +01:00
core	skbuff: introduce skb_expand_head()	2025-01-15 16:29:50 +01:00
dcb
dccp	dccp: Fix memory leak in dccp_feat_change_recv	2024-12-17 13:24:26 +01:00
decnet
dns_resolver
dsa
ethernet	Revert "gro: remove rcu_read_lock/rcu_read_unlock from gro_receive handlers"	2024-11-24 00:23:41 +01:00
ethtool	ethtool: Fix wrong mod state in case of verbose and no_mask bitset	2024-12-17 13:24:27 +01:00
hsr	net: hsr: avoid potential out-of-bound access in fill_frame_info()	2024-12-17 13:24:26 +01:00
ieee802154	net: ieee802154: do not leave a dangling sk pointer in ieee802154_create()	2024-12-17 13:24:30 +01:00
ife
ipv4	tcp_bpf: Charge receive socket buffer in bpf_tcp_ingress()	2025-01-15 16:29:48 +01:00
ipv6	ipv6: fix possible UAF in ip6_finish_output2()	2025-01-15 16:29:51 +01:00
iucv	Revert "net/iucv: fix use after free in iucv_sock_close()"	2024-11-24 00:23:55 +01:00
kcm	kcm: Serialise kcm_sendmsg() for the same socket.	2024-11-23 23:20:48 +01:00
key
l2tp	genetlink: hold RCU in genlmsg_mcast()	2024-11-23 23:21:59 +01:00
l3mdev	net: Add l3mdev index to flow struct and avoid oif reset for port devices	2024-11-23 23:21:52 +01:00
lapb
llc
mac80211	mac80211: fix user-power when emulating chanctx	2024-12-17 13:23:57 +01:00
mac802154	Revert "net: mac802154: Fix racy device stats updates by DEV_STATS_INC() and DEV_STATS_ADD()"	2024-11-19 14:52:14 +01:00
mpls
mptcp	Revert "mptcp: correct MPTCP_SUBFLOW_ATTR_SSN_OFFSET reserved size"	2024-11-24 00:23:53 +01:00
ncm
ncsi	net/ncsi: Fix the multi thread manner of NCSI driver	2024-11-19 14:19:00 +01:00
netfilter	netfilter: ipset: Fix for recursive locking warning	2025-01-15 16:29:41 +01:00
netlabel
netlink	netlink: terminate outstanding dump on socket close	2024-12-17 13:20:50 +01:00
netrom	Revert "Make more sysctl constants read-only"	2024-12-03 19:56:17 +01:00
nfc	nfc: nci: Fix handling of zero-length payload packets in nci_rx_work()	2024-11-19 12:27:10 +01:00
nsh	nsh: Restore skb->{protocol,data,mac_header} for outer header in nsh_gso_segment().	2024-11-19 11:32:42 +01:00
openvswitch	openvswitch: Set the skbuff pkt_type for proper pmtud support.	2024-11-19 12:27:09 +01:00
packet	af_packet: avoid erroring out after sock_init_data() in packet_create()	2024-12-17 13:24:30 +01:00
phonet	Revert "Make more sysctl constants read-only"	2024-12-03 19:56:17 +01:00
psample
qrtr	Revert "net: qrtr: Update packets cloning when broadcasting"	2024-11-24 00:23:18 +01:00
rds	Revert "net:rds: Fix possible deadlock in rds_message_put"	2024-11-24 00:23:49 +01:00
rfkill	net: rfkill: gpio: Add check for clk_enable()	2024-12-17 13:24:07 +01:00
rose	Revert "Make more sysctl constants read-only"	2024-12-03 19:56:17 +01:00
rxrpc
sched	net: sched: fix ordering of qlen adjustment	2025-01-15 16:29:40 +01:00
sctp	Revert "Make more sysctl constants read-only"	2024-12-03 19:56:17 +01:00
skb_tracer
smc	net/smc: check return value of sock_recvmsg when draining clc data	2025-01-15 16:29:41 +01:00
strparser
sunrpc	sunrpc: clear XPRT_SOCK_UPD_TIMEOUT when reset transport	2024-12-17 13:24:23 +01:00
switchdev
tipc	tipc: fix NULL deref in cleanup_bearer()	2025-01-02 17:00:49 +01:00
tls	tls: fix missing memory barrier in tls_init	2024-11-19 12:27:09 +01:00
unix	Revert "af_unix: Remove put_pid()/put_cred() in copy_peercred()."	2024-11-24 00:23:43 +01:00
vmw_vsock	virtio/vsock: Fix accept_queue memory leak	2025-01-02 17:00:49 +01:00
wimax
wireless	Revert "wifi: nl80211: don't give key data to userspace"	2024-11-24 00:23:55 +01:00
x25	Revert "Make more sysctl constants read-only"	2024-12-03 19:56:17 +01:00
xdp	xsk: validate user input for XDP_{UMEM|COMPLETION}_FILL_RING	2024-11-19 11:32:19 +01:00
xfrm	xfrm: store and rely on direction to construct offload flags	2024-12-17 13:24:04 +01:00
compat.c
devres.c
Kconfig
Makefile
socket.c
sysctl_net.c
TEST_MAPPING