Cong Wang c6f0350441 net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too ...

[ Upstream commit 6ccbda44e2 ]

Similarly to the previous patch, we need to safe guard hfsc_dequeue()
too. But for this one, we don't have a reliable reproducer.

Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Reported-by: Gerrard Tai <gerrard.tai@starlabs.sg>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Reviewed-by: Jamal Hadi Salim <jhs@mojatatu.com>
Link: https://patch.msgid.link/20250417184732.943057-3-xiyou.wangcong@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

2025-05-02 07:59:02 +02:00

..

6lowpan

…

9p

…

802

net: 802: LLC+SNAP OID:PID lookup on start of skb data

2025-01-17 13:40:37 +01:00

8021q

net: vlan: don't propagate flags on open

2025-04-20 10:15:21 +02:00

appletalk

…

atm

atm: Fix NULL pointer dereference

2025-04-07 10:08:35 +02:00

ax25

ax25: Fix refcount leak caused by setting SO_BINDTODEVICE sockopt

2025-02-21 14:01:16 +01:00

batman-adv

batman-adv: Ignore own maximum aggregation size during RX

2025-03-28 22:03:31 +01:00

bluetooth

Bluetooth: l2cap: Process valid commands in too long frame

2025-04-25 10:47:51 +02:00

bpf

bpf, test_run: Fix use-after-free issue in eth_skb_pkt_type()

2025-02-27 04:30:18 -08:00

bridge

net: bridge: switchdev: do not notify new brentries as changed

2025-04-25 10:47:45 +02:00

caif

…

can

can: statistics: use atomic access in hot path

2025-04-10 14:39:31 +02:00

ceph

ceph: allocate sparse_ext map only for sparse reads

2025-01-02 10:34:09 +01:00

core

net: lwtunnel: disable BHs when required

2025-05-02 07:59:01 +02:00

dcb

…

dccp

…

devlink

devlink: fix xa_alloc_cyclic() error handling

2025-03-28 22:03:27 +01:00

dns_resolver

…

dsa

net: dsa: avoid refcount warnings when ds->ops->tag_8021q_vlan_del() fails

2025-04-25 10:47:46 +02:00

ethernet

…

ethtool

ethtool: cmis_cdb: use correct rpl size in ethtool_cmis_module_poll()

2025-04-25 10:47:43 +02:00

handshake

…

hsr

net: hsr: fix fill_frame_info() regression vs VLAN packets

2025-02-08 09:58:08 +01:00

ieee802154

…

ife

…

ipv4

net: fix geneve_opt length integer overflow

2025-04-10 14:39:34 +02:00

ipv6

ipv6: add exception routes to GC list in rt6_insert_exception

2025-04-25 10:47:41 +02:00

iucv

…

kcm

…

key

xfrm: Add support for per cpu xfrm state handling.

2025-02-08 09:58:00 +01:00

l2tp

…

l3mdev

…

lapb

…

llc

llc: do not use skb_get() before dev_queue_xmit()

2025-03-13 13:02:05 +01:00

mac80211

Revert "wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()"

2025-04-25 10:47:41 +02:00

mac802154

mac802154: check local interfaces before deleting sdata list

2025-01-23 17:22:54 +01:00

mctp

net: mctp: Set SOCK_RCU_FREE

2025-04-25 10:47:43 +02:00

mpls

…

mptcp

mptcp: only inc MPJoinAckHMacFailure for HMAC failures

2025-04-20 10:15:45 +02:00

ncsi

net/ncsi: wait for the last response to Deselect Package before configuring channel

2025-02-17 10:05:41 +01:00

netfilter

nft_set_pipapo: fix incorrect avx2 match of 5th field octet

2025-04-20 10:15:09 +02:00

netlabel

…

netlink

…

netrom

netrom: check buffer length before accessing it

2025-01-09 13:33:38 +01:00

nfc

NFC: nci: Add bounds checking in nci_hci_create_pipe()

2025-02-17 10:05:40 +01:00

nsh

…

openvswitch

net: openvswitch: fix nested key length validation in the set() action

2025-04-25 10:47:43 +02:00

packet

af_packet: fix vlan_get_protocol_dgram() vs MSG_PEEK

2025-01-09 13:33:42 +01:00

phonet

…

psample

psample: adjust size if rate_as_probability is set

2024-12-27 14:02:06 +01:00

qrtr

…

rds

rds: sysctl: rds_tcp_{rcv,snd}buf: avoid using current->nsproxy

2025-01-17 13:40:47 +01:00

rfkill

…

rose

net: rose: lock the socket in rose_bind()

2025-02-17 10:05:01 +01:00

rxrpc

rxrpc: rxperf: Fix missing decoding of terminal magic cookie

2025-03-07 18:25:29 +01:00

sched

net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too

2025-05-02 07:59:02 +02:00

sctp

sctp: detect and prevent references to a freed transport in sendmsg

2025-04-20 10:15:50 +02:00

smc

smc: Fix lockdep false-positive for IPPROTO_SMC.

2025-04-25 10:47:42 +02:00

strparser

strparser: Add read_sock callback

2025-02-27 04:30:19 -08:00

sunrpc

svcrdma: do not unregister device for listeners

2025-04-20 10:15:43 +02:00

switchdev

net: switchdev: Convert blocking notification chain to a raw one

2025-03-22 12:54:12 -07:00

tipc

tipc: fix NULL pointer dereference in tipc_mon_reinit_self()

2025-05-02 07:59:02 +02:00

tls

net: tls: explicitly disallow disconnect

2025-04-20 10:15:06 +02:00

unix

…

vmw_vsock

vsock: avoid timeout during connect() if the socket is closing

2025-04-10 14:39:34 +02:00

wireless

wifi: cfg80211: cancel wiphy_work before freeing wiphy

2025-03-22 12:54:10 -07:00

x25

…

xdp

xsk: fix an integer overflow in xp_create_and_assign_umem()

2025-03-28 22:03:31 +01:00

xfrm

xfrm_output: Force software GSO only in tunnel mode

2025-03-28 22:03:25 +01:00

compat.c

…

devres.c

…

Kconfig

…

Kconfig.debug

…

Makefile

…

socket.c

…

sysctl_net.c

…