Eric DumazetandGreg Kroah-Hartman 975f764e96 ipv6: prevent possible UAF in ip6_xmit() ...

[ Upstream commit 2d5ff7e339 ]

If skb_expand_head() returns NULL, skb has been freed
and the associated dst/idev could also have been freed.

We must use rcu_read_lock() to prevent a possible UAF.

Fixes: 0c9f227bee ("ipv6: use skb_expand_head in ip6_xmit")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Vasily Averin <vasily.averin@linux.dev>
Reviewed-by: David Ahern <dsahern@kernel.org>
Link: https://patch.msgid.link/20240820160859.3786976-4-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

2024-09-04 13:23:34 +02:00

..

ila

ila: block BH in ila_output()

2024-07-27 10:46:09 +02:00

netfilter

netfilter: allow ipv6 fragments to arrive on different devices

2024-09-04 13:23:19 +02:00

addrconf_core.c

ipv6: Ensure natural alignment of const ipv6 loopback and router addresses

2024-02-23 08:54:54 +01:00

addrconf.c

ipv6: take care of scope when choosing the src addr

2024-08-19 05:45:11 +02:00

addrlabel.c

…

af_inet6.c

ipv6: annotate some data-races around sk->sk_prot

2024-07-05 09:14:50 +02:00

ah6.c

…

anycast.c

…

calipso.c

…

datagram.c

…

esp6_offload.c

…

esp6.c

net: esp: cleanup esp_output_tail_tcp() in case of unsupported ESPINTCP

2024-08-19 05:44:55 +02:00

exthdrs_core.c

…

exthdrs_offload.c

…

exthdrs.c

…

fib6_notifier.c

…

fib6_rules.c

ipv6: fib6_rules: avoid possible NULL dereference in fib6_rule_action()

2024-05-17 11:50:58 +02:00

fou6.c

…

icmp.c

icmp6: Fix null-ptr-deref of ip6_null_entry->rt6i_idev in icmp6_dev().

2023-07-23 13:47:41 +02:00

inet6_connection_sock.c

…

inet6_hashtables.c

net: remove duplicate reuseport_lookup functions

2024-06-16 13:39:21 +02:00

ioam6_iptunnel.c

…

ioam6.c

…

ip6_checksum.c

…

ip6_fib.c

ipv6: fix possible race in __fib6_drop_pcpu_from()

2024-07-05 09:14:09 +02:00

ip6_flowlabel.c

…

ip6_gre.c

erspan: make sure erspan_base_hdr is present in skb->head

2024-04-10 16:19:38 +02:00

ip6_icmp.c

…

ip6_input.c

ipv6: annotate data-races around cnf.disable_ipv6

2024-07-18 13:07:43 +02:00

ip6_offload.c

…

ip6_offload.h

…

ip6_output.c

ipv6: prevent possible UAF in ip6_xmit()

2024-09-04 13:23:34 +02:00

ip6_tunnel.c

ip6_tunnel: Fix broken GRO

2024-09-04 13:23:32 +02:00

ip6_udp_tunnel.c

…

ip6_vti.c

ip6_vti: fix slab-use-after-free in decode_session6

2023-08-26 14:23:32 +02:00

ip6mr.c

ip6mr: Fix skb_under_panic in ip6mr_cache_report()

2023-08-11 15:13:53 +02:00

ipcomp6.c

…

ipv6_sockglue.c

tcp: Fix data races around icsk->icsk_af_ops.

2024-07-05 09:14:51 +02:00

Kconfig

…

Makefile

…

mcast_snoop.c

…

mcast.c

ipv6: mcast: remove one synchronize_net() barrier in ipv6_mc_down()

2024-03-26 18:21:19 -04:00

mip6.c

…

ndisc.c

ipv6: fix ndisc_is_useropt() handling for PIO

2024-08-19 05:45:32 +02:00

netfilter.c

…

output_core.c

…

ping.c

…

proc.c

…

protocol.c

…

raw.c

…

reassembly.c

net: ipv6: fix wrong start position when receive hop-by-hop fragment

2024-06-16 13:39:25 +02:00

route.c

ipv6: prevent possible NULL dereference in rt6_probe()

2024-07-05 09:14:29 +02:00

rpl_iptunnel.c

net: ipv6: rpl_iptunnel: block BH in rpl_output() and rpl_input()

2024-07-27 10:46:09 +02:00

rpl.c

…

seg6_hmac.c

ipv6: sr: fix memleak in seg6_hmac_init_algo

2024-06-16 13:39:47 +02:00

seg6_iptunnel.c

ipv6: sr: block BH in seg6_output_core() and seg6_input_core()

2024-07-05 09:14:06 +02:00

seg6_local.c

seg6: fix parameter passing when calling NF_HOOK() in End.DX4 and End.DX6 behaviors

2024-07-05 09:14:31 +02:00

seg6.c

ipv6: sr: fix invalid unregister error path

2024-06-16 13:39:26 +02:00

sit.c

…

syncookies.c

dccp/tcp: Call security_inet_conn_request() after setting IPv6 addresses.

2023-11-20 11:08:28 +01:00

sysctl_net_ipv6.c

…

tcp_ipv6.c

tcp: fix races in tcp_v[46]_err()

2024-08-19 05:44:56 +02:00

tcpv6_offload.c

…

tunnel6.c

…

udp_impl.h

…

udp_offload.c

udp: do not transition UDP GRO fraglist partial checksums to unnecessary

2024-04-10 16:19:39 +02:00

udp.c

udp: Avoid call to compute_score on multiple sites

2024-06-16 13:39:21 +02:00

udplite.c

…

xfrm6_input.c

xfrm: Preserve vlan tags for transport mode software GRO

2024-05-17 11:50:57 +02:00

xfrm6_output.c

…

xfrm6_policy.c

xfrm6: check ip6_dst_idev() return value in xfrm6_get_saddr()

2024-07-05 09:14:29 +02:00

xfrm6_protocol.c

…

xfrm6_state.c

…

xfrm6_tunnel.c

…