Ksawlii/kernel_samsung_a53x
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
kernel_samsung_a53x/net/ipv4
History
Eric Dumazet f5d13a708c net: fix __dst_negative_advice() race 
commit 92f1655aa2b2294d0b49925f3b875a634bd3b59e upstream.

__dst_negative_advice() does not enforce proper RCU rules when
sk->dst_cache must be cleared, leading to possible UAF.

RCU rules are that we must first clear sk->sk_dst_cache,
then call dst_release(old_dst).

Note that sk_dst_reset(sk) is implementing this protocol correctly,
while __dst_negative_advice() uses the wrong order.

Given that ip6_negative_advice() has special logic
against RTF_CACHE, this means each of the three ->negative_advice()
existing methods must perform the sk_dst_reset() themselves.

Note the check against NULL dst is centralized in
__dst_negative_advice(), there is no need to duplicate
it in various callbacks.

Many thanks to Clement Lecigne for tracking this issue.

This old bug became visible after the blamed commit, using UDP sockets.

Fixes: a87cb3e48ee8 ("net: Facility to report route quality of connected sockets")
Reported-by: Clement Lecigne <clecigne@google.com>
Diagnosed-by: Clement Lecigne <clecigne@google.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Tom Herbert <tom@herbertland.com>
Reviewed-by: David Ahern <dsahern@kernel.org>
Link: https://lore.kernel.org/r/20240528114353.1794151-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
[Lee: Stable backport]
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2024-11-19 12:27:19 +01:00
..
bpfilter Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
netfilter netfilter: tproxy: bail out if IP has been disabled on the device 2024-11-19 12:27:10 +01:00
af_inet.c inet: read sk->sk_family once in inet_recv_error() 2024-11-18 12:13:25 +01:00
ah4.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
arp.c arp: Prevent overflow in arp_req_get(). 2024-11-18 22:25:42 +01:00
bpf_tcp_ca.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
cipso_ipv4.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
datagram.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
devinet.c ipv4: properly combine dev_base_seq and ipv4.dev_addr_genid 2024-11-18 22:25:41 +01:00
esp4.c net: ipv4: fix return value check in esp_remove_trailer 2024-11-08 11:26:10 +01:00
esp4_offload.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
fib_frontend.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
fib_lookup.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
fib_notifier.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
fib_rules.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
fib_semantics.c ipv4/fib: send notify when delete source address routes 2024-11-08 11:26:17 +01:00
fib_trie.c ipv4/fib: send notify when delete source address routes 2024-11-08 11:26:17 +01:00
fou.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
gre_demux.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
gre_offload.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
icmp.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
igmp.c bpf: net: Change do_ip_getsockopt() to take the sockptr_t argument 2024-11-19 08:44:49 +01:00
inet_connection_sock.c tcp: properly terminate timers for kernel sockets 2024-11-19 09:22:44 +01:00
inet_diag.c inet_diag: annotate data-races around inet_diag_table[] 2024-11-19 08:44:38 +01:00
inet_fragment.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
inet_hashtables.c net: remove duplicate reuseport_lookup functions 2024-11-19 12:26:55 +01:00
inet_timewait_sock.c tcp: Fix NEW_SYN_RECV handling in inet_twsk_purge() 2024-11-19 11:32:40 +01:00
inetpeer.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ip_forward.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ip_fragment.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ip_gre.c erspan: make sure erspan_base_hdr is present in skb->head 2024-11-19 09:22:47 +01:00
ip_input.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ip_options.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ip_output.c net: ipv4: fix a memleak in ip_setup_cork 2024-11-18 12:13:22 +01:00
ip_sockglue.c bpf: net: Change do_ip_getsockopt() to take the sockptr_t argument 2024-11-19 08:44:49 +01:00
ip_tunnel.c Revert "net: ip_tunnel: make sure to pull inner header in ip_tunnel_rcv()" 2024-11-19 09:03:26 +01:00
ip_tunnel_core.c tunnels: fix out of bounds access when building IPv6 PMTU error 2024-11-18 12:13:24 +01:00
ip_vti.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ipcomp.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ipconfig.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ipip.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ipmr.c ipmr: fix incorrect parameter validation in the ip_mroute_getsockopt() function 2024-11-19 08:44:50 +01:00
ipmr_base.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
Kconfig Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
Makefile Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
metrics.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
netfilter.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
netlink.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
nexthop.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ping.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
proc.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
protocol.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
raw.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
raw_diag.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
route.c net: fix __dst_negative_advice() race 2024-11-19 12:27:19 +01:00
syncookies.c tcp: fix cookie_init_timestamp() overflows 2024-11-18 11:42:50 +01:00
sysctl_net_ipv4.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
tcp.c tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets 2024-11-19 11:32:45 +01:00
tcp_bbr.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
tcp_bic.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
tcp_bpf.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
tcp_cdg.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
tcp_cong.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
tcp_cubic.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
tcp_dctcp.c tcp: Fix shift-out-of-bounds in dctcp_update_alpha(). 2024-11-19 12:27:09 +01:00
tcp_dctcp.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
tcp_diag.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
tcp_fastopen.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
tcp_highspeed.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
tcp_htcp.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
tcp_hybla.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
tcp_illinois.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
tcp_input.c tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets 2024-11-19 11:32:45 +01:00
tcp_ipv4.c tcp: avoid premature drops in tcp_add_backlog() 2024-11-19 12:26:55 +01:00
tcp_lp.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
tcp_metrics.c tcp_metrics: do not create an entry from tcp_init_metrics() 2024-11-18 11:42:49 +01:00
tcp_minisocks.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
tcp_nv.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
tcp_offload.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
tcp_output.c tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets 2024-11-19 11:32:45 +01:00
tcp_rate.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
tcp_recovery.c tcp: fix excessive TLP and RACK timeouts from HZ rounding 2024-11-08 11:26:10 +01:00
tcp_scalable.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
tcp_timer.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
tcp_ulp.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
tcp_vegas.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
tcp_vegas.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
tcp_veno.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
tcp_westwood.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
tcp_yeah.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
tunnel4.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
udp.c udp: Avoid call to compute_score on multiple sites 2024-11-19 12:26:55 +01:00
udp_bpf.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
udp_diag.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
udp_impl.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
udp_offload.c net: gro: add flush check in udp_gro_receive_segment 2024-11-19 11:32:43 +01:00
udp_tunnel_core.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
udp_tunnel_nic.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
udp_tunnel_stub.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
udplite.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
xfrm4_input.c xfrm: Preserve vlan tags for transport mode software GRO 2024-11-19 11:32:45 +01:00
xfrm4_output.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
xfrm4_policy.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
xfrm4_protocol.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
xfrm4_state.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
xfrm4_tunnel.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00