Dmitry Antipov e10f4d31cc net: sched: fix use-after-free in taprio_change() ... [ Upstream commit f504465970aebb2467da548f7c1efbbf36d0f44b ] In 'taprio_change()', 'admin' pointer may become dangling due to sched switch / removal caused by 'advance_sched()', and critical section protected by 'q->current_entry_lock' is too small to prevent from such a scenario (which causes use-after-free detected by KASAN). Fix this by prefer 'rcu_replace_pointer()' over 'rcu_assign_pointer()' to update 'admin' immediately before an attempt to schedule freeing. Fixes: a3d43c0d56f1 ("taprio: Add support adding an admin schedule") Reported-by: syzbot+b65e0af58423fc8a73aa@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=b65e0af58423fc8a73aa Acked-by: Vinicius Costa Gomes <vinicius.gomes@intel.com> Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru> Link: https://patch.msgid.link/20241018051339.418890-1-dmantipov@yandex.ru Signed-off-by: Paolo Abeni <pabeni@redhat.com> Signed-off-by: Sasha Levin <sashal@kernel.org>		2024-11-23 23:22:01 +01:00
..
6lowpan
9p	net/9p: fix uninit-value in p9_client_rpc()	2024-11-19 12:27:18 +01:00
802
8021q	gro: remove rcu_read_lock/rcu_read_unlock from gro_complete handlers	2024-11-23 23:21:04 +01:00
appletalk
atm
ax25
batman-adv	batman-adv: fix random jitter calculation	2024-11-19 17:55:48 +01:00
bluetooth	Bluetooth: bnep: fix wild-memory-access in proto_unregister	2024-11-23 23:21:59 +01:00
bpf
bpfilter
bridge	netfilter: br_netfilter: fix panic with metadata_dst skb	2024-11-23 23:21:51 +01:00
caif
can	can: bcm: Clear bo->bcm_proc_read after remove_proc_entry().	2024-11-23 23:21:18 +01:00
ceph	libceph: fix race between delayed_work() and ceph_monc_stop()	2024-11-19 14:19:45 +01:00
core	net: add more sanity checks to qdisc_pkt_len_init()	2024-11-23 23:21:35 +01:00
dcb
dccp
decnet
dns_resolver	keys, dns: Fix size check of V1 server-list header	2024-11-18 12:12:43 +01:00
dsa
ethernet	gro: remove rcu_read_lock/rcu_read_unlock from gro_complete handlers	2024-11-23 23:21:04 +01:00
ethtool	ethtool: check device is present when getting link settings	2024-11-23 23:20:55 +01:00
hsr	hsr: Handle failures in module init	2024-11-19 08:44:59 +01:00
ieee802154
ife
ipv4	xfrm: respect ip protocols rules criteria when performing dst lookups	2024-11-23 23:22:00 +01:00
ipv6	xfrm: respect ip protocols rules criteria when performing dst lookups	2024-11-23 23:22:00 +01:00
iucv	s390/iucv: fix receive buffer virtual vs physical address confusion	2024-11-23 23:20:47 +01:00
kcm	kcm: Serialise kcm_sendmsg() for the same socket.	2024-11-23 23:20:48 +01:00
key
l2tp	genetlink: hold RCU in genlmsg_mcast()	2024-11-23 23:21:59 +01:00
l3mdev	net: Add l3mdev index to flow struct and avoid oif reset for port devices	2024-11-23 23:21:52 +01:00
lapb
llc	llc: call sock_orphan() at release time	2024-11-18 12:13:22 +01:00
mac80211	wifi: mac80211: fix potential key use-after-free	2024-11-23 23:21:54 +01:00
mac802154	Revert "net: mac802154: Fix racy device stats updates by DEV_STATS_INC() and DEV_STATS_ADD()"	2024-11-19 14:52:14 +01:00
mpls
mptcp	mptcp: handle consistently DSS corruption	2024-11-23 23:21:57 +01:00
ncm
ncsi	net/ncsi: Fix the multi thread manner of NCSI driver	2024-11-19 14:19:00 +01:00
netfilter	netfilter: ctnetlink: compile ctnetlink_label_size with CONFIG_NF_CONNTRACK_EVENTS	2024-11-23 23:21:28 +01:00
netlabel	calipso: fix memory leak in netlbl_calipso_add_pass()	2024-11-18 12:12:25 +01:00
netlink	genetlink: hold RCU in genlmsg_mcast()	2024-11-23 23:21:59 +01:00
netrom	netrom: Fix a memory leak in nr_heartbeat_expiry()	2024-11-19 14:19:08 +01:00
nfc	nfc: nci: Fix handling of zero-length payload packets in nci_rx_work()	2024-11-19 12:27:10 +01:00
nsh	nsh: Restore skb->{protocol,data,mac_header} for outer header in nsh_gso_segment().	2024-11-19 11:32:42 +01:00
openvswitch	openvswitch: Set the skbuff pkt_type for proper pmtud support.	2024-11-19 12:27:09 +01:00
packet	af_packet: Handle outgoing VLAN packets without hardware offloading	2024-11-23 23:20:12 +01:00
phonet	phonet: fix rtm_phonet_notify() skb allocation	2024-11-19 11:32:46 +01:00
psample
qrtr	net: qrtr: Update packets cloning when broadcasting	2024-11-23 23:21:28 +01:00
rds	net:rds: Fix possible deadlock in rds_message_put	2024-11-23 23:20:54 +01:00
rfkill
rose
rxrpc	rxrpc: Fix response to PING RESPONSE ACKs to a dead call	2024-11-18 12:13:25 +01:00
sched	net: sched: fix use-after-free in taprio_change()	2024-11-23 23:22:01 +01:00
sctp	sctp: ensure sk_state is set to CLOSED if hashing fails in sctp_listen_start	2024-11-23 23:21:52 +01:00
skb_tracer
smc	net/smc: Fix searching in list of known pnetids in smc_pnet_add_pnetid	2024-11-23 23:21:59 +01:00
strparser
sunrpc	net, sunrpc: Remap EPERM in case of connection failure in xs_tcp_setup_socket	2024-11-23 23:21:09 +01:00
switchdev
tipc	tipc: guard against string buffer overrun	2024-11-23 23:21:38 +01:00
tls	tls: fix missing memory barrier in tls_init	2024-11-19 12:27:09 +01:00
unix	af_unix: Remove put_pid()/put_cred() in copy_peercred().	2024-11-23 23:21:03 +01:00
vmw_vsock	virtio/vsock: fix logic which reduces credit update messages	2024-11-18 12:12:37 +01:00
wimax
wireless	genetlink: hold RCU in genlmsg_mcast()	2024-11-23 23:21:59 +01:00
x25	net/x25: fix incorrect parameter validation in the x25_getsockopt() function	2024-11-19 08:44:50 +01:00
xdp	xsk: validate user input for XDP_{UMEM|COMPLETION}_FILL_RING	2024-11-19 11:32:19 +01:00
xfrm	xfrm: respect ip protocols rules criteria when performing dst lookups	2024-11-23 23:22:00 +01:00
compat.c
devres.c
Kconfig
Makefile
socket.c	net: Save and restore msg_namelen in sock_sendmsg	2024-11-18 12:12:07 +01:00
sysctl_net.c
TEST_MAPPING