Repository files (latest commit first)

Filename	Latest commit message	Latest commit date
Xin Long d0194e391b sctp: linearize cloned gso packets in sctp_rcv ... [ Upstream commit fd60d8a086191fe33c2d719732d2482052fa6805 ] A cloned head skb still shares these frag skbs in fraglist with the original head skb. It's not safe to access these frag skbs. syzbot reported two use-of-uninitialized-memory bugs caused by this: BUG: KMSAN: uninit-value in sctp_inq_pop+0x15b7/0x1920 net/sctp/inqueue.c:211 sctp_inq_pop+0x15b7/0x1920 net/sctp/inqueue.c:211 sctp_assoc_bh_rcv+0x1a7/0xc50 net/sctp/associola.c:998 sctp_inq_push+0x2ef/0x380 net/sctp/inqueue.c:88 sctp_backlog_rcv+0x397/0xdb0 net/sctp/input.c:331 sk_backlog_rcv+0x13b/0x420 include/net/sock.h:1122 __release_sock+0x1da/0x330 net/core/sock.c:3106 release_sock+0x6b/0x250 net/core/sock.c:3660 sctp_wait_for_connect+0x487/0x820 net/sctp/socket.c:9360 sctp_sendmsg_to_asoc+0x1ec1/0x1f00 net/sctp/socket.c:1885 sctp_sendmsg+0x32b9/0x4a80 net/sctp/socket.c:2031 inet_sendmsg+0x25a/0x280 net/ipv4/af_inet.c:851 sock_sendmsg_nosec net/socket.c:718 [inline] and BUG: KMSAN: uninit-value in sctp_assoc_bh_rcv+0x34e/0xbc0 net/sctp/associola.c:987 sctp_assoc_bh_rcv+0x34e/0xbc0 net/sctp/associola.c:987 sctp_inq_push+0x2a3/0x350 net/sctp/inqueue.c:88 sctp_backlog_rcv+0x3c7/0xda0 net/sctp/input.c:331 sk_backlog_rcv+0x142/0x420 include/net/sock.h:1148 __release_sock+0x1d3/0x330 net/core/sock.c:3213 release_sock+0x6b/0x270 net/core/sock.c:3767 sctp_wait_for_connect+0x458/0x820 net/sctp/socket.c:9367 sctp_sendmsg_to_asoc+0x223a/0x2260 net/sctp/socket.c:1886 sctp_sendmsg+0x3910/0x49f0 net/sctp/socket.c:2032 inet_sendmsg+0x269/0x2a0 net/ipv4/af_inet.c:851 sock_sendmsg_nosec net/socket.c:712 [inline] This patch fixes it by linearizing cloned gso packets in sctp_rcv(). Fixes: 90017accff ("sctp: Add GSO support") Reported-by: syzbot+773e51afe420baaf0e2b@syzkaller.appspotmail.com Reported-by: syzbot+70a42f45e76bede082be@syzkaller.appspotmail.com Signed-off-by: Xin Long <lucien.xin@gmail.com> Reviewed-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com> Link: https://patch.msgid.link/dd7dc337b99876d4132d0961f776913719f7d225.1754595611.git.lucien.xin@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>		2025-08-28 16:21:24 +02:00
..
6lowpan
9p	9p/xen: fix release of IRQ	2024-12-14 19:44:41 +01:00
802	net: 802: LLC+SNAP OID:PID lookup on start of skb data	2025-02-01 18:18:45 +01:00
8021q	net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime	2025-08-28 16:21:16 +02:00
appletalk	net: appletalk: Fix use-after-free in AARP proxy probe	2025-08-28 16:21:17 +02:00
atm	atm: clip: Fix NULL pointer dereference in vcc_sendmsg()	2025-07-17 18:25:02 +02:00
ax25
batman-adv	batman-adv: Ignore own maximum aggregation size during RX	2025-04-10 14:29:38 +02:00
bluetooth	Bluetooth: L2CAP: Fix attempting to adjust outgoing MTU	2025-08-28 16:21:16 +02:00
bpf
bpfilter	bpfilter: match bit size of bpfilter_umh to that of the kernel	2025-07-17 18:24:51 +02:00
bridge	netfilter: bridge: Move specific fragmented packet to slow_path instead of dropping it	2025-06-27 11:02:46 +01:00
caif	caif: reduce stack size, again	2025-08-28 16:21:19 +02:00
can	can: bcm: add missing rcu read protection for procfs content	2025-06-04 14:32:35 +02:00
ceph
core	netpoll: prevent hanging NAPI when netcons gets enabled	2025-08-28 16:21:22 +02:00
dcb
dccp	net: fix data-races around sk->sk_forward_alloc	2025-02-01 18:18:52 +01:00
decnet
dns_resolver
dsa
ethernet
hsr
ieee802154	net: ieee802154: do not leave a dangling sk pointer in ieee802154_create()	2024-12-14 19:44:51 +01:00
ife
ipv4	udp: also consider secpath when evaluating ipsec use for checksumming	2025-08-28 16:21:24 +02:00
ipv6	ipv6: reject malicious packets in ipv6_gso_segment()	2025-08-28 16:21:22 +02:00
iucv
kcm
key
l2tp	genetlink: hold RCU in genlmsg_mcast()	2024-11-08 16:20:50 +01:00
l3mdev
lapb
llc	llc: fix data loss when reading from a socket in llc_ui_recvmsg()	2025-06-04 14:32:35 +02:00
mac80211	Reapply "wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()"	2025-08-28 16:21:20 +02:00
mac802154	mac802154: check local interfaces before deleting sdata list	2025-02-01 18:18:50 +01:00
mpls	mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu().	2025-06-27 11:02:57 +01:00
ncsi	net: ncsi: Fix GCPS 64-bit member variables	2025-06-27 11:02:46 +01:00
netfilter	netfilter: ctnetlink: fix refcount leak on table dump	2025-08-28 16:21:24 +02:00
netlabel	calipso: unlock rcu before returning -EAFNOSUPPORT	2025-06-27 11:02:50 +01:00
netlink	netlink: avoid infinite retry looping in netlink_unicast()	2025-08-28 16:21:23 +02:00
netrom	netrom: check buffer length before accessing it	2025-01-09 13:23:35 +01:00
nfc	NFC: nci: uart: Set tty->disc_data only in success path	2025-06-27 11:02:51 +01:00
nsh
openvswitch	openvswitch: Fix unsafe attribute parsing in output_userspace()	2025-06-04 14:32:29 +02:00
packet	net/packet: fix a race in packet_set_ring() and packet_notifier()	2025-08-28 16:21:23 +02:00
phonet	phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept()	2025-08-28 16:21:14 +02:00
psample
qrtr	net: qrtr: Update packets cloning when broadcasting	2024-11-08 16:20:33 +01:00
rds
rfkill	net: rfkill: gpio: Add check for clk_enable()	2024-12-14 19:44:27 +01:00
rose	rose: fix dangling neighbour pointers in rose_rt_device_down()	2025-07-17 18:25:00 +02:00
rxrpc	rxrpc: Fix oops due to non-existence of prealloc backlog struct	2025-07-17 18:25:02 +02:00
sched	net/sched: Restrict conditions for adding duplicating netems to qdisc tree	2025-08-28 16:21:19 +02:00
sctp	sctp: linearize cloned gso packets in sctp_rcv	2025-08-28 16:21:24 +02:00
smc	net/smc: check sndbuf_space again after NOSPACE flag is set in smc_poll	2025-01-09 13:23:27 +01:00
strparser
sunrpc	xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create	2025-06-27 11:02:58 +01:00
switchdev
tipc	tipc: Fix use-after-free in tipc_conn_close().	2025-07-17 18:25:01 +02:00
tls	bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls	2025-08-28 16:21:19 +02:00
unix
vmw_vsock	vsock: Do not allow binding to VMADDR_PORT_ANY	2025-08-28 16:21:23 +02:00
wimax
wireless	wifi: nl80211: reject cooked mode if it is set along with other flags	2025-03-13 12:43:28 +01:00
x25
xdp
xfrm	xfrm: Sanitize marks before insert	2025-06-04 14:32:35 +02:00
compat.c
Kconfig
Makefile
socket.c
sysctl_net.c