Ignat Korchagin f8a3f255f7 net: inet: do not leave a dangling sk pointer in inet_create() ...

[ Upstream commit 9365fa510c ]

sock_init_data() attaches the allocated sk object to the provided sock
object. If inet_create() fails later, the sk object is freed, but the
sock object retains the dangling pointer, which may create use-after-free
later.

Clear the sk pointer in the sock object on error.

Signed-off-by: Ignat Korchagin <ignat@cloudflare.com>
Reviewed-by: Kuniyuki Iwashima <kuniyu@amazon.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Link: https://patch.msgid.link/20241014153808.51894-7-ignat@cloudflare.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

2024-12-14 19:44:51 +01:00

..

bpfilter

…

netfilter

netfilter: nf_tables: prevent nf_skb_duplicated corruption

2024-11-08 16:20:36 +01:00

af_inet.c

net: inet: do not leave a dangling sk pointer in inet_create()

2024-12-14 19:44:51 +01:00

ah4.c

…

arp.c

ipv4: Invalidate neighbour for broadcast address upon address addition

2022-04-15 14:18:33 +02:00

cipso_ipv4.c

cipso: fix total option length computation

2024-07-05 09:08:22 +02:00

datagram.c

…

devinet.c

ipv4: give an IPv4 dev to blackhole_netdev

2024-11-08 16:20:49 +01:00

esp4_offload.c

xfrm: Linearize the skb after offloading if needed.

2023-06-28 10:18:38 +02:00

esp4.c

net: ipv4: fix return value check in esp_remove_trailer

2023-10-25 11:53:21 +02:00

fib_frontend.c

ipv4: Mask upper DSCP bits and ECN bits in NETLINK_FIB_LOOKUP family

2024-11-08 16:20:37 +01:00

fib_lookup.h

…

fib_notifier.c

…

fib_rules.c

…

fib_semantics.c

ipv4: fib: annotate races around nh->nh_saddr_genid and nh->nh_saddr

2023-10-25 11:53:21 +02:00

fib_trie.c

ipv4: annotate data-races around fi->fib_dead

2023-09-23 10:59:58 +02:00

fou.c

…

gre_demux.c

…

gre_offload.c

…

icmp.c

icmp: guard against too small mtu

2023-04-20 12:07:33 +02:00

igmp.c

ipv4: igmp: fix refcnt uaf issue when receiving igmp query packet

2023-12-08 08:44:27 +01:00

inet_connection_sock.c

net: annotate lockless accesses to sk->sk_max_ack_backlog

2024-11-08 16:20:46 +01:00

inet_diag.c

inet_diag: Initialize pad field in struct inet_diag_req_v2

2024-07-18 11:40:50 +02:00

inet_fragment.c

inet: inet_defrag: prevent sk release while still in use

2024-11-08 16:20:26 +01:00

inet_hashtables.c

net: set SOCK_RCU_FREE before inserting socket into hashtable

2024-09-12 11:03:50 +02:00

inet_timewait_sock.c

tcp: Fix NEW_SYN_RECV handling in inet_twsk_purge()

2024-05-02 16:18:37 +02:00

inetpeer.c

inetpeer: Fix data-races around sysctl.

2022-07-21 20:59:20 +02:00

ip_forward.c

…

ip_fragment.c

inet: inet_defrag: prevent sk release while still in use

2024-11-08 16:20:26 +01:00

ip_gre.c

ipv4: ip_gre: Fix drops of small packets in ipgre_xmit

2024-11-08 16:20:36 +01:00

ip_input.c

tcp/udp: Make early_demux back namespacified.

2022-11-10 17:57:55 +01:00

ip_options.c

…

ip_output.c

net: ipv4: fix a memleak in ip_setup_cork

2024-02-23 08:25:05 +01:00

ip_sockglue.c

ipv{4,6}/raw: fix output xfrm lookup wrt protocol

2023-06-05 08:17:33 +02:00

ip_tunnel_core.c

…

ip_tunnel.c

net: ip_tunnel: make sure to pull inner header in ip_tunnel_rcv()

2024-03-26 18:22:17 -04:00

ip_vti.c

ip_vti: fix potential slab-use-after-free in decode_session6

2023-08-30 16:27:16 +02:00

ipcomp.c

…

ipconfig.c

…

ipip.c

…

ipmr_base.c

ipmr: Fix access to mfc_cache_list without lock held

2024-12-14 19:44:21 +01:00

ipmr.c

ipmr: fix tables suspicious RCU usage

2024-12-14 19:44:34 +01:00

Kconfig

tcp: configurable source port perturb table size

2022-12-08 11:23:00 +01:00

Makefile

…

metrics.c

ipv4: prevent potential spectre v1 gadget in ip_metrics_convert()

2023-02-06 07:52:45 +01:00

netfilter.c

…

netlink.c

…

nexthop.c

net: nexthop: Initialize all fields in dumped nexthops

2024-08-19 05:33:41 +02:00

ping.c

ping: fix address binding wrt vrf

2022-05-18 09:47:28 +02:00

proc.c

…

protocol.c

…

raw_diag.c

…

raw.c

ipv{4,6}/raw: fix output xfrm lookup wrt protocol

2023-06-05 08:17:33 +02:00

route.c

ipv4: Fix incorrect source address in Record Route option

2024-08-19 05:33:41 +02:00

syncookies.c

tcp: fix cookie_init_timestamp() overflows

2023-11-20 10:30:10 +01:00

sysctl_net_ipv4.c

tcp/udp: Make early_demux back namespacified.

2022-11-10 17:57:55 +01:00

tcp_bbr.c

…

tcp_bic.c

…

tcp_bpf.c

tcp_bpf: Fix the sk_mem_uncharge logic in tcp_bpf_sendmsg

2024-12-14 19:44:47 +01:00

tcp_cdg.c

tcp: cdg: allow tcp_cdg_release() to be called multiple times

2022-11-25 17:42:21 +01:00

tcp_cong.c

…

tcp_cubic.c

…

tcp_dctcp.c

tcp: Fix shift-out-of-bounds in dctcp_update_alpha().

2024-06-16 13:28:45 +02:00

tcp_dctcp.h

…

tcp_diag.c

net: annotate lockless accesses to sk->sk_max_ack_backlog

2024-11-08 16:20:46 +01:00

tcp_fastopen.c

tcp: add TCP_INFO status for failed client TFO

2024-07-18 11:40:53 +02:00

tcp_highspeed.c

…

tcp_htcp.c

…

tcp_hybla.c

…

tcp_illinois.c

…

tcp_input.c

tcp: fix tcp_enter_recovery() to zero retrans_stamp when it's safe

2024-11-08 16:20:45 +01:00

tcp_ipv4.c

net: annotate lockless accesses to sk->sk_ack_backlog

2024-11-08 16:20:46 +01:00

tcp_lp.c

…

tcp_metrics.c

tcp_metrics: validate source addr length

2024-07-18 11:40:50 +02:00

tcp_minisocks.c

tcp: tcp_check_req() can be called from process context

2023-03-11 16:44:12 +01:00

tcp_nv.c

…

tcp_offload.c

…

tcp_output.c

tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets

2024-05-17 11:43:53 +02:00

tcp_rate.c

tcp: ensure to use the most recently sent skb when filling the rate sample

2022-05-09 09:03:24 +02:00

tcp_recovery.c

tcp: fix excessive TLP and RACK timeouts from HZ rounding

2023-10-25 11:53:21 +02:00

tcp_scalable.c

…

tcp_timer.c

tcp: avoid too many retransmit packets

2024-07-18 11:40:56 +02:00

tcp_ulp.c

…

tcp_vegas.c

…

tcp_vegas.h

…

tcp_veno.c

…

tcp_westwood.c

…

tcp_yeah.c

…

tcp.c

net: annotate lockless accesses to sk->sk_max_ack_backlog

2024-11-08 16:20:46 +01:00

tunnel4.c

…

udp_diag.c

…

udp_impl.h

…

udp_offload.c

…

udp_tunnel.c

net/tunnel: wait until all sk_user_data reader finish before releasing the sock

2023-01-18 11:41:14 +01:00

udp.c

udp: Set SOCK_RCU_FREE earlier in udp_lib_get_port().

2024-07-18 11:40:53 +02:00

udplite.c

udplite: Fix NULL pointer dereference in __sk_mem_raise_allocated().

2023-05-30 12:44:09 +01:00

xfrm4_input.c

xfrm: Preserve vlan tags for transport mode software GRO

2024-05-17 11:43:53 +02:00

xfrm4_output.c

…

xfrm4_policy.c

…

xfrm4_protocol.c

net: xfrm: unexport __init-annotated xfrm4_protocol_init()

2022-06-14 18:11:58 +02:00

xfrm4_state.c

…

xfrm4_tunnel.c

…