Thadeu Lima de Souza Cascardo a26ff37e62 net: fix out-of-bounds access in ops_init ... net_alloc_generic is called by net_alloc, which is called without any locking. It reads max_gen_ptrs, which is changed under pernet_ops_rwsem. It is read twice, first to allocate an array, then to set s.len, which is later used to limit the bounds of the array access. It is possible that the array is allocated and another thread is registering a new pernet ops, increments max_gen_ptrs, which is then used to set s.len with a larger than allocated length for the variable array. Fix it by reading max_gen_ptrs only once in net_alloc_generic. If max_gen_ptrs is later incremented, it will be caught in net_assign_generic. Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@igalia.com> Fixes: 073862ba5d ("netns: fix net_alloc_generic()") Reviewed-by: Eric Dumazet <edumazet@google.com> Reviewed-by: Kuniyuki Iwashima <kuniyu@amazon.com> Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20240502132006.3430840-1-cascardo@igalia.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>		2024-05-06 13:38:14 +02:00
..
6lowpan	net: fill in MODULE_DESCRIPTION()s for 6LoWPAN	2024-02-09 14:12:01 -08:00
9p	9p: Fix read/write debug statements to report server reply	2024-02-12 21:18:54 +09:00
802
8021q	net: gro: fix udp bad offset in socket lookup by adding {inner_}network_offset to napi_gro_cb	2024-05-02 11:02:48 +02:00
appletalk
atm	net: fill in MODULE_DESCRIPTION()s for mpoa	2024-02-09 14:12:01 -08:00
ax25	ax25: Fix netdev refcount issue	2024-04-23 11:35:52 +02:00
batman-adv	batman-adv: Avoid infinite loop trying to resize local TT	2024-03-29 20:18:43 +01:00
bluetooth	Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout	2024-05-03 13:05:54 -04:00
bpf	for-netdev	2024-03-11 18:06:04 -07:00
bridge	net: bridge: fix multicast-to-unicast with fraglist GSO	2024-05-01 11:44:10 +01:00
caif	net: fill in MODULE_DESCRIPTION()s for CAIF	2024-01-05 08:06:35 -08:00
can	linux-can-next-for-6.9-20240220	2024-02-20 15:32:45 +01:00
ceph	libceph: init the cursor when preparing sparse read in msgr2	2024-03-06 12:43:01 +01:00
core	net: fix out-of-bounds access in ops_init	2024-05-06 13:38:14 +02:00
dcb
dccp	Kbuild updates for v6.9	2024-03-21 14:41:00 -07:00
devlink	devlink: fix port new reply cmd type	2024-03-19 19:37:57 -07:00
dns_resolver	Networking changes for 6.8.	2024-01-11 10:07:29 -08:00
dsa	net: dsa: Leverage core stats allocator	2024-03-07 20:37:13 -08:00
ethernet	ethernet: Add helper for assigning packet type when dest address does not match device address	2024-04-25 08:20:54 -07:00
ethtool	ethtool: remove ethtool_eee_use_linkmodes	2024-03-06 20:40:20 -08:00
handshake	net/handshake: Fix handshake_req_destroy_test1	2024-02-08 18:32:29 -08:00
hsr	net: hsr: Use full string description when opening HSR network device	2024-03-29 10:42:21 +00:00
ieee802154	Merge tag 'ieee802154-for-net-next-2024-03-07' of git://git.kernel.org/pub/scm/linux/kernel/git/wpan/wpan-next	2024-03-08 20:35:33 -08:00
ife
ipv4	ipsec-2024-05-02	2024-05-03 15:56:15 -07:00
ipv6	ipsec-2024-05-02	2024-05-03 15:56:15 -07:00
iucv	more s390 updates for 6.9 merge window	2024-03-19 11:38:27 -07:00
kcm	net: kcm: fix incorrect parameter validation in the kcm_getsockopt) function	2024-03-11 09:53:22 +00:00
key	net: fill in MODULE_DESCRIPTION()s for af_key	2024-02-09 14:12:01 -08:00
l2tp	net l2tp: drop flow hash on forward	2024-04-26 13:48:24 +02:00
l3mdev
lapb
llc	llc: call sock_orphan() at release time	2024-01-30 13:49:09 +01:00
mac80211	wifi: mac80211: fix unaligned le16 access	2024-04-19 10:02:27 +02:00
mac802154	mac802154: fix llsec key resources release in mac802154_llsec_key_del	2024-03-06 21:01:26 +01:00
mctp	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2024-02-29 14:24:56 -08:00
mpls	- Kuan-Wei Chiu has developed the well-named series "lib min_heap: Min	2024-03-14 18:03:09 -07:00
mptcp	mptcp: ensure snd_nxt is properly initialized on connect	2024-04-30 18:48:28 -07:00
ncsi
netfilter	netfilter: nf_tables: honor table dormant flag from netdev release event path	2024-04-25 10:42:57 +02:00
netlabel	netlabel: remove impossible return value in netlbl_bitmap_walk	2024-02-28 19:37:34 -08:00
netlink	net/netlink: Add getsockopt support for NETLINK_LISTEN_ALL_NSID	2024-03-11 15:48:34 -07:00
netrom	netrom: Fix data-races around sysctl_net_busy_read	2024-03-07 10:36:58 +01:00
nfc	nfc: llcp: fix nfc_llcp_setsockopt() unsafe copies	2024-04-09 17:01:01 -07:00
nsh	nsh: Restore skb->{protocol,data,mac_header} for outer header in nsh_gso_segment().	2024-04-26 12:20:01 +02:00
openvswitch	net: openvswitch: Fix Use-After-Free in ovs_ct_exit	2024-04-24 17:14:24 -07:00
packet	Revert "net: Re-use and set mono_delivery_time bit for userspace tstamp packets"	2024-03-18 12:29:53 +00:00
phonet	phonet/pep: fix racy skb_queue_empty() use	2024-02-22 09:05:50 +01:00
psample
qrtr	net: qrtr: ns: Return 0 if server port is not present	2024-01-01 18:41:29 +00:00
rds	net/rds: fix possible cp null dereference	2024-03-29 12:04:09 -07:00
rfkill
rose
rxrpc	rxrpc: Clients must accept conn from any address	2024-05-01 14:49:56 -07:00
sched	net/sched: Fix mirred deadlock on device recursion	2024-04-17 18:22:52 -07:00
sctp	net: introduce include/net/rps.h	2024-03-07 21:12:43 -08:00
smc	net/smc: reduce rtnl pressure in smc_pnet_create_pnetids_list()	2024-03-05 15:49:35 +01:00
strparser
sunrpc	NFS client bugfixes for Linux 6.9	2024-04-29 12:07:37 -07:00
switchdev	net: bridge: switchdev: Skip MDB replays of deferred events on offload	2024-02-16 09:36:37 +00:00
tipc	tipc: fix a possible memleak in tipc_buf_append	2024-05-01 18:39:44 -07:00
tls	tls: fix lockless read of strp->msg_ready in ->poll	2024-04-25 08:32:37 -07:00
unix	af_unix: Suppress false-positive lockdep splat for spin_lock() in __unix_gc().	2024-04-25 08:37:02 -07:00
vmw_vsock	vsock/virtio: fix packet delivery to tap device	2024-04-02 18:00:24 -07:00
wireless	wifi: nl80211: don't free NULL coalescing rule	2024-04-19 10:02:17 +02:00
x25	net/x25: fix incorrect parameter validation in the x25_getsockopt() function	2024-03-11 09:53:22 +00:00
xdp	xsk: validate user input for XDP_{UMEM|COMPLETION}_FILL_RING	2024-04-05 22:47:22 -07:00
xfrm	xfrm: Preserve vlan tags for transport mode software GRO	2024-04-26 06:44:33 +02:00
compat.c
devres.c
Kconfig	net: bql: allow the config to be disabled	2024-02-18 10:19:21 +00:00
Kconfig.debug
Makefile	af_unix: Remove CONFIG_UNIX_SCM.	2024-01-31 16:41:16 -08:00
socket.c	net: remove {revc,send}msg_copy_msghdr() from exports	2024-03-14 16:48:53 -07:00
sysctl_net.c