averello/linux-stable-mirror
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2026-04-08 12:02:33 +02:00
Code Issues Packages Projects Releases Wiki Activity
Files
fcb74331c483cdade3007fbe7bfbc60d152841c8
linux-stable-mirror/include/net
History
Nikhil P. Rao 2a9ea98846 xsk: Fix fragment node deletion to prevent buffer leak 
[ Upstream commit 60abb0ac11 ]

After commit b692bf9a75 ("xsk: Get rid of xdp_buff_xsk::xskb_list_node"),
the list_node field is reused for both the xskb pool list and the buffer
free list, this causes a buffer leak as described below.

xp_free() checks if a buffer is already on the free list using
list_empty(&xskb->list_node). When list_del() is used to remove a node
from the xskb pool list, it doesn't reinitialize the node pointers.
This means list_empty() will return false even after the node has been
removed, causing xp_free() to incorrectly skip adding the buffer to the
free list.

Fix this by using list_del_init() instead of list_del() in all fragment
handling paths, this ensures the list node is reinitialized after removal,
allowing the list_empty() to work correctly.

Fixes: b692bf9a75 ("xsk: Get rid of xdp_buff_xsk::xskb_list_node")
Acked-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com>
Signed-off-by: Nikhil P. Rao <nikhil.rao@amd.com>
Link: https://patch.msgid.link/20260225000456.107806-2-nikhil.rao@amd.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Stable-dep-of: f7387d6579 ("xsk: Fix zero-copy AF_XDP fragment drop")
Signed-off-by: Sasha Levin <sashal@kernel.org>
2026-03-13 17:20:39 +01:00
..
9p
netfs, 9p: Implement helpers for new write code
2024-05-01 18:07:37 +01:00
bluetooth
Bluetooth: L2CAP: Fix result of L2CAP_ECRED_CONN_RSP when MTU is too short
2026-03-04 07:21:32 -05:00
caif
net: Correct spelling in headers
2024-08-26 09:37:23 -07:00
iucv
s390/iucv: Correct spelling in iucv.h
2024-08-26 09:37:22 -07:00
libeth
libeth: add Tx buffer completion helpers
2024-09-09 13:15:37 -07:00
mana
net: mana: Change the function signature of mana_get_primary_netdev_rcu
2026-02-06 16:55:51 +01:00
netfilter
netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation
2026-03-04 07:20:09 -05:00
netns
inet: move icmp_global_{credit,stamp} to a separate cache line
2026-03-04 07:20:39 -05:00
nfc
nfc: nci: Fix race between rfkill and nci_unregister_device().
2026-02-06 16:55:42 +01:00
page_pool
page_pool: Track DMA-mapped pages and unmap them when destroying the pool
2025-06-19 15:31:42 +02:00
phonet
…
sctp
sctp: detect and prevent references to a freed transport in sendmsg
2025-04-20 10:15:50 +02:00
tc_act
net_sched: act_connmark: use RCU in tcf_connmark_dump()
2025-11-24 10:35:51 +01:00
6lowpan.h
…
act_api.h
net/sched: Add helper macros with module names
2024-02-02 10:57:55 -08:00
addrconf.h
net: Correct spelling in headers
2024-08-26 09:37:23 -07:00
af_ieee802154.h
…
af_rxrpc.h
…
af_unix.h
af_unix: Remove U_LOCK_GC_LISTENER.
2024-06-25 11:10:18 +02:00
af_vsock.h
vsock: fix vsock_proto declaration
2025-07-17 18:37:05 +02:00
ah.h
…
amt.h
…
arp.h
…
atmclip.h
…
ax25.h
ax25: rcu protect dev->ax25_ptr
2025-02-08 09:57:10 +01:00
ax88796.h
…
bareudp.h
…
bond_3ad.h
bonding: update LACP activity flag after setting lacp_active
2025-08-28 16:31:15 +02:00
bond_alb.h
bonding: Correct spelling in headers
2024-08-26 09:37:22 -07:00
bond_options.h
bonding: add ns target multicast address to slave device
2024-11-14 11:16:28 +01:00
bonding.h
bonding: annotate data-races around slave->last_rx
2026-02-06 16:55:41 +01:00
bpf_sk_storage.h
…
busy_poll.h
Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
2024-08-29 11:49:10 -07:00
calipso.h
move asm/unaligned.h to linux/unaligned.h
2024-10-02 17:23:23 -04:00
cfg80211-wext.h
…
cfg80211.h
wifi: cfg80211: add an hrtimer based delayed work item
2025-11-24 10:36:05 +01:00
cfg802154.h
mac802154: fix llsec key resources release in mac802154_llsec_key_del
2024-03-06 21:01:26 +01:00
checksum.h
net: Fix checksum update for ILA adj-transport
2025-06-27 11:11:40 +01:00
cipso_ipv4.h
move asm/unaligned.h to linux/unaligned.h
2024-10-02 17:23:23 -04:00
cls_cgroup.h
net/cls_cgroup: Fix task_get_classid() during qdisc run
2025-11-13 15:34:24 -05:00
codel_impl.h
…
codel_qdisc.h
…
codel.h
…
compat.h
…
datalink.h
…
dcbevent.h
…
dcbnl.h
…
devlink.h
devlink: Constify the 'table_ops' parameter of devl_dpipe_table_register()
2024-06-05 10:24:57 +01:00
dropreason-core.h
net: vxlan: rename SKB_DROP_REASON_VXLAN_NO_REMOTE
2025-09-09 18:58:11 +02:00
dropreason.h
…
dsa_stubs.h
…
dsa.h
net: dsa: provide implementation of .support_eee()
2025-09-09 18:58:19 +02:00
dscp.h
net: add IEEE 802.1q specific helpers
2024-05-08 10:35:09 +01:00
dsfield.h
…
dst_cache.h
net: Correct spelling in headers
2024-08-26 09:37:23 -07:00
dst_metadata.h
net: Silence false field-spanning write warning in metadata_dst memcpy
2024-08-20 15:22:17 -07:00
dst_ops.h
net: fix __dst_negative_advice() race
2024-05-29 17:34:49 -07:00
dst.h
net: dst: introduce dst->dev_rcu
2025-12-18 13:55:22 +01:00
eee.h
net: add helpers for EEE configuration
2024-03-05 19:21:17 -08:00
erspan.h
net: Correct spelling in headers
2024-08-26 09:37:23 -07:00
esp.h
…
espintcp.h
inet: preserve const qualifier in inet_csk()
2024-04-01 21:27:08 -07:00
ethoc.h
…
failover.h
…
fib_notifier.h
…
fib_rules.h
…
firewire.h
…
flow_dissector.h
flow_dissector: cleanup FLOW_DISSECTOR_KEY_ENC_FLAGS
2024-07-15 09:14:39 -07:00
flow_offload.h
flow_offload: add encapsulation control flag helpers
2024-06-12 17:56:00 -07:00
flow.h
…
fou.h
…
fq_impl.h
…
fq.h
…
garp.h
…
gen_stats.h
…
genetlink.h
genetlink: hold RCU in genlmsg_mcast()
2024-10-15 17:52:58 -07:00
geneve.h
…
gre.h
ip_tunnel: convert __be16 tunnel flags to bitmaps
2024-04-01 10:49:28 +01:00
gro_cells.h
…
gro.h
net: allow small head cache usage with large MAX_SKB_FRAGS values
2025-02-27 04:30:18 -08:00
gso.h
…
gtp.h
gtp: properly parse extension headers
2024-05-07 01:35:55 +02:00
gue.h
…
handshake.h
…
hotdata.h
net: move sysctl_mem_pcpu_rsv to net_hotdata
2024-04-30 18:46:52 -07:00
hwbm.h
net: Correct spelling in headers
2024-08-26 09:37:23 -07:00
icmp.h
…
ieee8021q.h
net: add IEEE 802.1q specific helpers
2024-05-08 10:35:09 +01:00
ieee80211_radiotap.h
Merge tag 'wireless-2024-10-21' of git://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless
2024-10-25 10:44:41 +01:00
ieee802154_netdev.h
…
if_inet6.h
ipv6: anycast: complete RCU handling of struct ifacaddr6
2024-02-26 18:40:34 -08:00
ife.h
…
inet6_connection_sock.h
…
inet6_hashtables.h
tcp: convert to dev_net_rcu()
2025-10-23 16:20:44 +02:00
inet_common.h
net: change proto and proto_ops accept type
2024-05-13 18:19:09 -06:00
inet_connection_sock.h
tcp: cache RTAX_QUICKACK metric in a hot cache line
2025-10-23 16:20:45 +02:00
inet_dscp.h
…
inet_ecn.h
…
inet_frag.h
net: Rename mono_delivery_time to tstamp_type for scalabilty
2024-05-23 14:14:23 -07:00
inet_hashtables.h
ipv4: adopt dst_dev, skb_dst_dev and skb_dst_dev_net[_rcu]
2025-10-23 16:20:45 +02:00
inet_sock.h
inet: constify inet_sk_bound_dev_eq() net parameter
2024-08-05 16:22:45 -07:00
inet_timewait_sock.h
tcp: remove volatile qualifier on tw_substate
2024-08-28 17:08:16 -07:00
inetpeer.h
inetpeer: remove create argument of inet_getpeer()
2025-02-08 09:57:06 +01:00
ioam6.h
ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data()
2026-03-04 07:21:57 -05:00
ip6_checksum.h
…
ip6_fib.h
ipv6: introduce dst_rt6_info() helper
2024-04-29 13:32:01 +01:00
ip6_route.h
net: use dst_dev_rcu() in sk_setup_caps()
2026-01-08 10:15:01 +01:00
ip6_tunnel.h
ip_tunnel: convert __be16 tunnel flags to bitmaps
2024-04-01 10:49:28 +01:00
ip_fib.h
ipv4: Fix user space build failure due to header change
2024-09-04 16:40:33 -07:00
ip_tunnels.h
net: tunnel: make skb_vlan_inet_prepare() return drop reasons
2026-02-12 13:14:56 +01:00
ip_vs.h
…
ip.h
net: use dst_dev_rcu() in sk_setup_caps()
2026-01-08 10:15:01 +01:00
ipcomp.h
…
ipconfig.h
…
ipv6_frag.h
…
ipv6_stubs.h
ipv6: udp: constify 'struct net' parameter of socket lookups
2024-08-05 16:27:26 -07:00
ipv6.h
ipv6: annotate data-races in ip6_multipath_hash_{policy,fields}()
2026-03-04 07:21:13 -05:00
iw_handler.h
wifi: cfg80211: wext: Update spelling and grammar
2024-09-03 11:49:27 +02:00
kcm.h
net: kcm: Fix race condition in kcm_unattach()
2025-08-20 18:30:18 +02:00
l3mdev.h
vrf: use RCU protection in l3mdev_l3_out()
2025-02-21 14:01:16 +01:00
lag.h
…
lapb.h
net: lapb: increase LAPB_HEADER_LEN
2024-12-19 18:13:13 +01:00
lib80211.h
wifi: lib80211: Handle const struct lib80211_crypto_ops in lib80211
2024-08-27 10:28:49 +02:00
llc_c_ac.h
…
llc_c_ev.h
…
llc_c_st.h
llc: Constify struct llc_conn_state_trans
2024-07-15 08:51:01 -07:00
llc_conn.h
…
llc_if.h
…
llc_pdu.h
net: Correct spelling in headers
2024-08-26 09:37:23 -07:00
llc_s_ac.h
…
llc_s_ev.h
…
llc_s_st.h
llc: Constify struct llc_sap_state_trans
2024-07-15 08:51:19 -07:00
llc_sap.h
…
llc.h
…
lwtunnel.h
net: dst: annotate data-races around dst->output
2025-08-15 12:13:41 +02:00
mac80211.h
wifi: mac80211: avoid weird state in error path
2025-08-20 18:30:32 +02:00
mac802154.h
move asm/unaligned.h to linux/unaligned.h
2024-10-02 17:23:23 -04:00
macsec.h
macsec: Enable devices to advertise whether they update sk_buff md_dst during offloads
2024-04-25 08:20:54 -07:00
mctp.h
mctp: Handle error of rtnl_register_module().
2024-10-10 15:39:35 +02:00
mctpdevice.h
…
mip6.h
…
mld.h
…
mpls_iptunnel.h
…
mpls.h
…
mptcp.h
mptcp: fallback to TCP after SYN+MPC drops
2024-09-11 15:57:50 -07:00
mrp.h
…
ncsi.h
…
ndisc.h
ipv6: eliminate ndisc_ops_is_useropt()
2024-08-12 17:23:57 -07:00
neighbour.h
neighbour: add support for NUD_PERMANENT proxy entries
2025-08-20 18:30:37 +02:00
net_debug.h
Rename .data.once to .data..once to fix resetting WARN*_ONCE
2024-12-05 14:03:08 +01:00
net_failover.h
…
net_namespace.h
net: Add net_passive_inc() and net_passive_dec().
2025-08-20 18:30:56 +02:00
net_ratelimit.h
…
net_trackers.h
…
netdev_queues.h
net: export a helper for adding up queue stats
2025-05-18 08:24:50 +02:00
netdev_rx_queue.h
memory-provider: fix compilation issue without SYSFS
2024-09-12 21:00:26 -07:00
netevent.h
…
netkit.h
…
netlabel.h
netlabel: Correct spelling in netlabel.h
2024-08-26 09:37:22 -07:00
netlink.h
net: Correct spelling in headers
2024-08-26 09:37:23 -07:00
netmem.h
page_pool: devmem support
2024-09-11 20:44:31 -07:00
netprio_cgroup.h
…
netrom.h
…
nexthop.h
net: nexthop: Increase weight to u16
2024-08-12 17:50:34 -07:00
nl802154.h
ieee802154: Correct spelling in nl802154.h
2024-08-30 22:30:55 +02:00
nsh.h
…
p8022.h
…
pfcp.h
pfcp: always set pfcp metadata
2024-04-01 10:49:28 +01:00
pie.h
…
ping.h
…
pkt_cls.h
net: sched: refine software bypass handling in tc_run
2025-02-08 09:57:25 +01:00
pkt_sched.h
net/sched: sch_qfq: Fix null-deref in agg_dequeue
2025-11-02 22:15:20 +09:00
pptp.h
…
proto_memory.h
net: move sysctl_mem_pcpu_rsv to net_hotdata
2024-04-30 18:46:52 -07:00
protocol.h
ipv6: move tcp_ipv6_hash_secret and udp_ipv6_hash_secret to net_hotdata
2024-03-07 21:12:43 -08:00
psample.h
net: psample: fix flag being set in wrong skb
2024-07-11 18:11:31 -07:00
psnap.h
…
raw.h
…
rawv6.h
…
red.h
net: sched: Correct spelling in headers
2024-08-26 09:37:23 -07:00
regulatory.h
net: Correct spelling in headers
2024-08-26 09:37:23 -07:00
request_sock.h
tcp: move reqsk_alloc() to inet_connection_sock.c
2024-06-06 15:18:04 +02:00
rose.h
net: rose: convert 'use' field to refcount_t
2025-09-04 15:31:51 +02:00
route.h
net: use dst_dev_rcu() in sk_setup_caps()
2026-01-08 10:15:01 +01:00
rpl.h
…
rps.h
net: rps: add rps_input_queue_head_add() helper
2024-04-01 11:28:32 +01:00
rsi_91x.h
…
rstreason.h
tcp: rstreason: introduce SK_RST_REASON_TCP_DISCONNECT_WITH_DATA for active reset
2024-08-07 10:24:46 +01:00
rtnetlink.h
rtnetlink: Add bulk registration helpers for rtnetlink message handlers.
2024-10-10 15:39:35 +02:00
rtnh.h
…
sch_generic.h
net: sched: generalize check for no-queue qdisc on TX queue
2025-12-07 06:24:54 +09:00
scm.h
af_unix: Add dead flag to struct scm_fp_list.
2024-05-10 18:52:45 -07:00
secure_seq.h
…
seg6_hmac.h
ipv6: sr: restruct ifdefines
2024-05-30 18:29:38 -07:00
seg6_local.h
seg6: Use nested-BH locking for seg6_bpf_srh_states.
2024-06-24 16:41:23 -07:00
seg6.h
ipv6: sr: restruct ifdefines
2024-05-30 18:29:38 -07:00
selftests.h
…
slhc_vj.h
…
smc.h
net/smc: add operations to merge sndbuf with peer DMB
2024-04-30 13:24:48 +02:00
snmp.h
…
sock_reuseport.h
net: core: annotate socks of struct sock_reuseport with __counted_by
2024-08-02 17:16:59 -07:00
sock.h
inet: Avoid ehash lookup race in inet_ehash_insert()
2025-12-18 13:54:44 +01:00
Space.h
…
stp.h
…
strparser.h
strparser: Add read_sock callback
2025-02-27 04:30:19 -08:00
switchdev.h
net: bridge: switchdev: Skip MDB replays of deferred events on offload
2024-02-16 09:36:37 +00:00
tc_wrapper.h
Merge branch 'x86/bugs' into x86/core, to pick up pending changes before dependent patches
2024-02-14 10:49:37 +01:00
tcp_ao.h
net/tcp: Add missing lockdep annotations for TCP-AO hlist traversals
2024-12-14 20:03:53 +01:00
tcp_states.h
…
tcp.h
bpf: Fix wrong copied_seq calculation
2025-02-27 04:30:19 -08:00
tcx.h
bpf: Fix too early release of tcx_entry
2024-07-08 14:07:31 -07:00
timewait_sock.h
tcp: get rid of twsk_unique()
2024-05-09 20:25:55 -07:00
tipc.h
…
tls_prot.h
…
tls_toe.h
…
tls.h
net: tls: Cancel RX async resync request on rcd_delta overflow
2025-12-01 11:43:36 +01:00
transp_v6.h
…
tso.h
…
tun_proto.h
…
udp_tunnel.h
ip_tunnel: convert __be16 tunnel flags to bitmaps
2024-04-01 10:49:28 +01:00
udp.h
net: drop UFO packets in udp_rcv_segment()
2025-08-15 12:14:06 +02:00
udplite.h
…
vsock_addr.h
…
vxlan.h
…
wext.h
…
x25.h
x25: Correct spelling in x25.h
2024-08-26 09:37:23 -07:00
x25device.h
…
xdp_priv.h
…
xdp_sock_drv.h
xsk: Fix fragment node deletion to prevent buffer leak
2026-03-13 17:20:39 +01:00
xdp_sock.h
xsk: Fix race condition in AF_XDP generic RX path
2025-05-09 09:50:38 +02:00
xdp.h
bpf: Clear pfmemalloc flag when freeing all fragments
2025-11-13 15:34:07 -05:00
xfrm.h
Revert "xfrm: destroy xfrm_state synchronously on net exit path"
2025-12-12 18:37:17 +01:00
xsk_buff_pool.h
xsk: s/free_list_node/list_node/
2026-03-13 17:20:39 +01:00