Minki/linux
1
0
Fork 1
mirror of https://github.com/torvalds/linux.git synced 2024-11-25 21:51:40 +00:00
Code Issues Packages Projects Releases Wiki Activity
1230fe7ad3
linux/net
History
Florian Westphal 1230fe7ad3 netfilter: bpf: must hold reference on net namespace 
BUG: KASAN: slab-use-after-free in __nf_unregister_net_hook+0x640/0x6b0
Read of size 8 at addr ffff8880106fe400 by task repro/72=
bpf_nf_link_release+0xda/0x1e0
bpf_link_free+0x139/0x2d0
bpf_link_release+0x68/0x80
__fput+0x414/0xb60

Eric says:
 It seems that bpf was able to defer the __nf_unregister_net_hook()
 after exit()/close() time.
 Perhaps a netns reference is missing, because the netns has been
 dismantled/freed already.
 bpf_nf_link_attach() does :
 link->net = net;
 But I do not see a reference being taken on net.

Add such a reference and release it after hook unreg.
Note that I was unable to get syzbot reproducer to work, so I
do not know if this resolves this splat.

Fixes: 84601d6ee6 ("bpf: add bpf_link support for BPF_NETFILTER programs")
Diagnosed-by: Eric Dumazet <edumazet@google.com>
Reported-by: Lai, Yi <yi1.lai@linux.intel.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2024-10-17 13:58:57 +02:00
..
6lowpan ipv6: eliminate ndisc_ops_is_useropt() 2024-08-12 17:23:57 -07:00
9p net/9p/usbg: fix CONFIG_USB_GADGET dependency 2024-09-11 15:59:43 +02:00
802 move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
8021q netdev_features: remove NETIF_F_ALL_FCOE 2024-09-03 11:36:43 +02:00
appletalk
atm
ax25
batman-adv move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
bluetooth Bluetooth: hci_conn: Fix UAF in hci_enhanced_setup_sync 2024-10-04 16:54:17 -04:00
bpf bpf: use type_may_be_null() helper for nullable-param check 2024-09-05 13:29:06 -07:00
bridge bridge: Handle error of rtnl_register_module(). 2024-10-10 15:39:35 +02:00
caif move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
can Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2024-09-15 09:13:19 -07:00
ceph libceph: use min() to simplify code in ceph_dns_resolve_name() 2024-08-27 09:30:16 +02:00
core rtnetlink: Add bulk registration helpers for rtnetlink message handlers. 2024-10-10 15:39:35 +02:00
dcb
dccp move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
devlink
dns_resolver
dsa net: dsa: refuse cross-chip mirroring operations 2024-10-09 19:41:35 -07:00
ethernet
ethtool net: ethtool: phy: Don't set the context dev pointer for unfiltered DUMP 2024-09-13 21:40:12 -07:00
handshake net/handshake: use sockfd_put() helper 2024-08-27 16:09:25 -07:00
hsr Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2024-09-12 17:11:24 -07:00
ieee802154 netdev_features: convert NETIF_F_NETNS_LOCAL to dev->netns_local 2024-09-03 11:36:43 +02:00
ife
ipv4 udp: Compute L4 checksum as usual when not segmenting the skb 2024-10-15 18:12:33 -07:00
ipv6 udp: Compute L4 checksum as usual when not segmenting the skb 2024-10-15 18:12:33 -07:00
iucv s390/iucv: Fix vargs handling in iucv_alloc_device() 2024-08-22 13:09:20 -07:00
kcm kcm: Serialise kcm_sendmsg() for the same socket. 2024-08-19 18:36:12 -07:00
key
l2tp genetlink: hold RCU in genlmsg_mcast() 2024-10-15 17:52:58 -07:00
l3mdev
lapb
llc llc: Constify struct llc_sap_state_trans 2024-07-15 08:51:19 -07:00
mac80211 move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
mac802154 Including fixes from ieee802154, bluetooth and netfilter. 2024-10-03 09:44:00 -07:00
mctp mctp: Handle error of rtnl_register_module(). 2024-10-10 15:39:35 +02:00
mpls mpls: Handle error of rtnl_register_module(). 2024-10-10 15:39:35 +02:00
mptcp mptcp: pm: fix UaF read in mptcp_pm_nl_rm_addr_or_subflow 2024-10-17 12:06:55 +02:00
ncsi net/ncsi: Disable the ncsi work before freeing the associated structure 2024-10-03 10:14:14 +02:00
netfilter netfilter: bpf: must hold reference on net namespace 2024-10-17 13:58:57 +02:00
netlabel
netlink genetlink: hold RCU in genlmsg_mcast() 2024-10-15 17:52:58 -07:00
netrom net/netrom: prefer strscpy over strcpy 2024-08-29 12:33:07 -07:00
nfc
nsh
openvswitch netdev_features: convert NETIF_F_NETNS_LOCAL to dev->netns_local 2024-09-03 11:36:43 +02:00
packet net: add support for skbs with unreadable frags 2024-09-11 20:44:31 -07:00
phonet phonet: Handle error of rtnl_register_module(). 2024-10-10 15:39:36 +02:00
psample
qrtr net: qrtr: Update packets cloning when broadcasting 2024-09-24 10:48:16 +02:00
rds net: rds: add option for GCOV profiling 2024-08-09 13:18:46 +01:00
rfkill [tree-wide] finally take no_llseek out 2024-09-27 08:18:43 -07:00
rose
rxrpc rxrpc: Fix uninitialised variable in rxrpc_send_data() 2024-10-03 16:23:21 -07:00
sched net/sched: accept TCA_STAB only for root qdisc 2024-10-08 15:38:56 -07:00
sctp sctp: ensure sk_state is set to CLOSED if hashing fails in sctp_listen_start 2024-10-09 13:36:32 +01:00
smc net/smc: Fix searching in list of known pnetids in smc_pnet_add_pnetid 2024-10-15 10:56:31 -07:00
strparser
sunrpc move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
switchdev
tipc Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2024-09-15 09:13:19 -07:00
tls move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
unix af_unix: Don't return OOB skb in manage_oob(). 2024-09-09 17:14:27 -07:00
vmw_vsock virtio: bugfixes 2024-10-07 11:33:26 -07:00
wireless genetlink: hold RCU in genlmsg_mcast() 2024-10-15 17:52:58 -07:00
x25
xdp bpf-next-6.12 2024-09-21 09:27:50 -07:00
xfrm move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
compat.c
devres.c
Kconfig memory-provider: disable building dmabuf mp on !CONFIG_PAGE_POOL 2024-09-13 11:41:45 -07:00
Kconfig.debug
Makefile
socket.c net: explicitly clear the sk pointer, when pf->create fails 2024-10-07 16:21:59 -07:00
sysctl_net.c