averello/linux-stable-mirror
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2026-09-22 09:34:56 +02:00
Code Issues Packages Projects Releases Wiki Activity
Files
v6.6.155
linux-stable-mirror/include/net
T
History
Eric Dumazet 32fa602b5d inet: frags: change inet_frag_kill() to defer refcount updates 
[ Upstream commit eb0dfc0ef1 ]

In the following patch, we no longer assume inet_frag_kill()
callers own a reference.

Consuming two refcounts from inet_frag_kill() would lead in UAF.

Propagate the pointer to the refs that will be consumed later
by the final inet_frag_putn() call.

Signed-off-by: Eric Dumazet <edumazet@google.com>
Link: https://patch.msgid.link/20250312082250.1803501-4-edumazet@google.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Stable-dep-of: 653d7ddf6c ("inet: frags: publish queues before arming timer")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-08-27 14:29:44 +02:00
..
9p
…
bluetooth
Bluetooth: RFCOMM: Fix session UAF in set_termios
2026-08-03 11:15:28 +02:00
caif
…
iucv
…
mana
RDMA/mana_ib: Disable RX steering on RSS QP destroy
2026-05-17 17:13:49 +02:00
netfilter
netfilter: nf_tables: clone set on flush only
2026-08-09 20:22:03 +02:00
netns
inet: move icmp_global_{credit,stamp} to a separate cache line
2026-03-04 07:20:23 -05:00
nfc
nfc: nci: Fix race between rfkill and nci_unregister_device().
2026-02-06 16:48:23 +01:00
page_pool
…
phonet
phonet: Pass net and ifindex to phonet_address_notify().
2026-07-04 13:42:20 +02:00
sctp
sctp: fix auth_hmacs array size in struct sctp_cookie
2026-08-03 11:15:16 +02:00
tc_act
net/sched: act_pedit: fix TOCTOU heap OOB write in tc offload
2026-07-24 16:03:27 +02:00
6lowpan.h
…
act_api.h
net/sched: act_gact, act_police: range check the fallback control action
2026-08-19 18:13:12 +02:00
addrconf.h
ipv6: prevent in6_dev_get() from resurrecting inet6_dev
2026-08-19 18:13:12 +02:00
af_ieee802154.h
…
af_rxrpc.h
rxrpc: Pull out certain app callback funcs into an ops table
2026-08-03 11:15:34 +02:00
af_unix.h
af_unix: Give up GC if MSG_PEEK intervened.
2026-06-01 17:43:05 +02:00
af_vsock.h
vsock: fix vsock_proto declaration
2025-07-17 18:35:09 +02:00
ah.h
…
amt.h
…
arp.h
…
atmclip.h
…
ax25.h
ax25: rcu protect dev->ax25_ptr
2025-02-08 09:51:55 +01:00
ax88796.h
…
bareudp.h
…
bond_3ad.h
bonding: 3ad: implement proper RCU rules for port->aggregator
2026-05-23 13:03:31 +02:00
bond_alb.h
…
bond_options.h
bonding: add support for per-port LACP actor priority
2026-05-23 13:03:30 +02:00
bonding.h
bonding: fix xfrm offload feature setup on active-backup mode
2026-07-24 16:02:38 +02:00
bpf_sk_storage.h
…
busy_poll.h
net: busy-poll: use ktime_get_ns() instead of local_clock()
2024-09-04 13:28:28 +02:00
calipso.h
…
cfg80211-wext.h
…
cfg80211.h
wifi: cfg80211: Fix interface type validation
2025-08-28 16:28:20 +02:00
cfg802154.h
…
checksum.h
net: Fix checksum update for ILA adj-transport
2025-06-27 11:09:00 +01:00
cipso_ipv4.h
…
cls_cgroup.h
net/cls_cgroup: Fix task_get_classid() during qdisc run
2025-11-24 10:29:38 +01:00
codel_impl.h
…
codel_qdisc.h
…
codel.h
…
compat.h
…
datalink.h
…
dcbevent.h
…
dcbnl.h
…
devlink.h
…
dropreason-core.h
net: sched: Add initial TC error skb drop reasons
2026-08-23 14:20:06 +02:00
dropreason.h
…
dsa_stubs.h
…
dsa.h
net: dsa: properly keep track of conduit reference
2026-03-25 11:06:00 +01:00
dsfield.h
…
dst_cache.h
…
dst_metadata.h
…
dst_ops.h
…
dst.h
net: Add locking to protect skb->dev access in ip_output
2026-01-17 16:29:54 +01:00
erspan.h
…
esp.h
…
espintcp.h
…
ethoc.h
…
failover.h
…
fib_notifier.h
…
fib_rules.h
net: fib_rules: Don't dump dying fib_rule in fib_rules_dump().
2026-07-24 16:03:11 +02:00
firewire.h
…
flow_dissector.h
…
flow_offload.h
…
flow.h
…
fou.h
…
fq_impl.h
…
fq.h
…
garp.h
…
gen_stats.h
…
genetlink.h
genetlink: Use internal flags for multicast groups
2026-06-19 13:39:38 +02:00
geneve.h
…
gre.h
…
gro_cells.h
…
gro.h
net: move skb_gro_receive_list from udp to core
2026-08-23 14:20:01 +02:00
gso.h
…
gtp.h
…
gue.h
gue: validate REMCSUM private option length
2026-07-24 16:03:27 +02:00
handshake.h
…
hwbm.h
…
icmp.h
…
ieee80211_radiotap.h
wifi: radiotap: Avoid -Wflex-array-member-not-at-end warnings
2024-12-09 10:31:35 +01:00
ieee802154_netdev.h
…
if_inet6.h
…
ife.h
…
inet6_connection_sock.h
…
inet6_hashtables.h
…
inet_common.h
…
inet_connection_sock.h
tcp: Set pingpong threshold via sysctl
2026-03-04 07:20:22 -05:00
inet_dscp.h
…
inet_ecn.h
…
inet_frag.h
inet: frags: change inet_frag_kill() to defer refcount updates
2026-08-27 14:29:44 +02:00
inet_hashtables.h
udp: Fix wildcard bind conflict check when using hash2
2026-04-02 13:07:19 +02:00
inet_sock.h
…
inet_timewait_sock.h
…
inetpeer.h
inetpeer: remove create argument of inet_getpeer()
2025-02-08 09:51:53 +01:00
ioam6.h
ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data()
2026-03-04 07:21:18 -05:00
ip6_checksum.h
…
ip6_fib.h
ipv6: Don't remove permanent routes with exceptions from tb6_gc_hlist.
2026-04-02 13:07:18 +02:00
ip6_route.h
ipv6: introduce dst_rt6_info() helper
2024-12-14 19:59:35 +01:00
ip6_tunnel.h
…
ip_fib.h
ipv4: fib: Don't ignore error route in local/main tables.
2026-07-24 16:03:22 +02:00
ip_tunnels.h
net: tunnel: make skb_vlan_inet_prepare() return drop reasons
2026-02-19 16:28:28 +01:00
ip_vs.h
ipvs: separate destination availability state
2026-08-23 14:19:56 +02:00
ip.h
icmp: icmp_msgs_per_sec and icmp_msgs_burst sysctls become per netns
2026-03-04 07:20:21 -05:00
ipcomp.h
…
ipconfig.h
…
ipv6_frag.h
inet: frags: change inet_frag_kill() to defer refcount updates
2026-08-27 14:29:44 +02:00
ipv6_stubs.h
…
ipv6.h
ipv6: rename and move ip6_dst_lookup_tunnel()
2026-05-23 13:03:30 +02:00
iw_handler.h
…
kcm.h
…
l3mdev.h
vrf: use RCU protection in l3mdev_l3_out()
2025-02-21 13:57:07 +01:00
lag.h
…
lapb.h
net: lapb: increase LAPB_HEADER_LEN
2024-12-19 18:11:28 +01:00
lib80211.h
…
llc_c_ac.h
…
llc_c_ev.h
…
llc_c_st.h
…
llc_conn.h
…
llc_if.h
…
llc_pdu.h
…
llc_s_ac.h
…
llc_s_ev.h
…
llc_s_st.h
…
llc_sap.h
…
llc.h
…
lwtunnel.h
net: dst: annotate data-races around dst->output
2025-08-15 12:08:46 +02:00
mac80211.h
wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure
2026-04-27 07:23:33 -06:00
mac802154.h
…
macsec.h
…
mctp.h
net: mctp: fix don't require received header reserved bits to be zero
2026-05-17 17:13:49 +02:00
mctpdevice.h
…
mip6.h
…
mld.h
…
mpls_iptunnel.h
…
mpls.h
…
mptcp.h
…
mrp.h
…
ncsi.h
…
ndisc.h
…
neighbour.h
netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge()
2026-08-09 20:21:43 +02:00
net_debug.h
Rename .data.once to .data..once to fix resetting WARN*_ONCE
2024-12-09 10:32:59 +01:00
net_failover.h
…
net_namespace.h
net: Add net_passive_inc() and net_passive_dec().
2025-08-28 16:28:39 +02:00
net_ratelimit.h
…
net_trackers.h
…
netdev_queues.h
…
netdev_rx_queue.h
…
netevent.h
…
netlabel.h
…
netlink.h
netlink: add variable-length / auto integers
2025-09-09 18:56:22 +02:00
netprio_cgroup.h
…
netrom.h
…
nexthop.h
…
nl802154.h
…
nsh.h
…
p8022.h
…
pie.h
net/sched: sch_pie: annotate data-races in pie_dump_stats()
2026-05-23 13:03:25 +02:00
ping.h
…
pkt_cls.h
net: sched: Move drop_reason to struct tc_skb_cb
2026-08-23 14:20:06 +02:00
pkt_sched.h
net: sched: Move drop_reason to struct tc_skb_cb
2026-08-23 14:20:06 +02:00
pptp.h
…
protocol.h
…
psample.h
…
psnap.h
…
raw.h
…
rawv6.h
…
red.h
…
regulatory.h
…
request_sock.h
…
rose.h
net: rose: convert 'use' field to refcount_t
2025-09-04 15:30:25 +02:00
route.h
ipv4: fix use-after-free in fib_nhc_update_mtu()
2026-08-19 18:13:11 +02:00
rpl.h
…
rsi_91x.h
…
rtnetlink.h
net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink
2026-07-24 16:02:36 +02:00
rtnh.h
…
sch_generic.h
net: sched: Move drop_reason to struct tc_skb_cb
2026-08-23 14:20:06 +02:00
scm.h
af_unix: Add dead flag to struct scm_fp_list.
2025-06-04 14:42:24 +02:00
secure_seq.h
…
seg6_hmac.h
…
seg6_local.h
…
seg6.h
…
selftests.h
…
slhc_vj.h
…
smc.h
net/smc: add operations to merge sndbuf with peer DMB
2024-12-14 19:59:37 +01:00
snmp.h
…
sock_reuseport.h
…
sock.h
net: Drop the lock in skb_may_tx_timestamp()
2026-07-24 16:02:40 +02:00
Space.h
…
stp.h
…
strparser.h
strparser: Add read_sock callback
2025-02-27 04:10:50 -08:00
switchdev.h
…
tc_wrapper.h
…
tcp_ao.h
net/tcp: Add TCP-AO config and structures
2026-08-19 18:13:08 +02:00
tcp_states.h
…
tcp.h
tcp: challenge ACK for non-exact RST in SYN-RECEIVED
2026-08-23 14:20:02 +02:00
tcx.h
…
timewait_sock.h
…
tipc.h
…
tls_prot.h
…
tls_toe.h
…
tls.h
net: tls: Cancel RX async resync request on rcd_delta overflow
2025-12-01 11:41:50 +01:00
transp_v6.h
…
tso.h
…
tun_proto.h
…
udp_tunnel.h
ipv6: rename and move ip6_dst_lookup_tunnel()
2026-05-23 13:03:30 +02:00
udp.h
net: drop UFO packets in udp_rcv_segment()
2025-08-15 12:09:02 +02:00
udplite.h
…
vsock_addr.h
…
vxlan.h
…
wext.h
…
x25.h
…
x25device.h
…
xdp_priv.h
…
xdp_sock_drv.h
xsk: respect tailroom for ZC setups
2026-04-27 07:23:28 -06:00
xdp_sock.h
xsk: fix XDP_UMEM_SG_FLAG issues
2026-04-27 07:23:28 -06:00
xdp.h
bpf: Clear pfmemalloc flag when freeing all fragments
2025-11-24 10:29:22 +01:00
xfrm.h
xfrm: validate selector family and prefixlen during match
2026-07-24 16:03:18 +02:00
xsk_buff_pool.h
xsk: s/free_list_node/list_node/
2026-03-25 11:05:39 +01:00