Duoming Zhou
9acf05b4e7
net/x25: Fix null-ptr-deref caused by x25_disconnect ...
[ Upstream commit 7781607938c8371d4c2b243527430241c62e39c2 ]
When the link layer is terminating, x25->neighbour will be set to NULL
in x25_disconnect(). As a result, it could cause null-ptr-deref bugs in
x25_sendmsg(),x25_recvmsg() and x25_connect(). One of the bugs is
shown below.
(Thread 1) | (Thread 2)
x25_link_terminated() | x25_recvmsg()
x25_kill_by_neigh() | ...
x25_disconnect() | lock_sock(sk)
... | ...
x25->neighbour = NULL //(1) |
... | x25->neighbour->extended //(2)
The code sets NULL to x25->neighbour in position (1) and dereferences
x25->neighbour in position (2), which could cause null-ptr-deref bug.
This patch adds lock_sock() in x25_kill_by_neigh() in order to synchronize
with x25_sendmsg(), x25_recvmsg() and x25_connect(). What`s more, the
sock held by lock_sock() is not NULL, because it is extracted from x25_list
and uses x25_list_lock to synchronize.
Fixes: 4becb7ee5b3d ("net/x25: Fix x25_neigh refcnt leak when x25 disconnect")
Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
Reviewed-by: Lin Ma <linma@zju.edu.cn>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2022-04-15 14:18:21 +02:00
6lowpan: iphc: Fix an off-by-one check of array index
2021-09-15 09:47:31 +02:00
xen/9p: use alloc/free_pages_exact()
2022-03-11 11:22:39 +01:00
net/802/garp: fix memleak in garp_request_join()
2021-07-31 08:19:38 +02:00
net: vlan: fix underflow for the real_dev refcnt
2021-12-01 09:23:34 +01:00
ax25: Fix NULL pointer dereference in ax25_kill_by_device
2022-03-16 13:21:45 +01:00
batman-adv: Don't expect inter-netns unique iflink indices
2022-03-08 19:07:47 +01:00
Bluetooth: refactor malicious adv data check
2022-02-01 17:24:33 +01:00
bpfilter: Specify the log level for the kmsg message
2021-07-14 16:53:33 +02:00
net: bridge: fix stale eth hdr pointer in br_dev_xmit
2022-02-16 12:52:50 +01:00
net-caif: avoid user-triggerable WARN_ON(1)
2021-09-22 12:26:40 +02:00
can: j1939: j1939_tp_cmd_recv(): check the dst address of TP.CM_BAM
2021-12-08 09:01:08 +01:00
bpf, sockmap: Fix memleak in tcp_bpf_sendmsg while sk msg is full
2022-04-15 14:18:16 +02:00
net: dcb: disable softirqs in dcbnl_flush_dev()
2022-03-08 19:07:51 +01:00
dccp: don't duplicate ccid when cloning dccp sock
2021-09-22 12:26:40 +02:00
net: decnet: Fix sleeping inside in af_decnet
2021-07-28 13:30:56 +02:00
net: dsa: Add missing of_node_put() in dsa_port_parse_of
2022-03-23 09:12:07 +01:00
net: ieee802154: Return meaningful error codes from the netlink helpers
2022-02-08 18:24:31 +01:00
tcp: ensure PMTU updates are processed during fastopen
2022-04-15 14:18:17 +02:00
udp: call udp_encap_enable for v6 sockets when enabling encap
2022-04-15 14:18:01 +02:00
af_key: add __GFP_ZERO flag for compose_sadb_supported in function pfkey_register
2022-04-15 14:17:56 +02:00
net/l2tp: Fix reference count leak in l2tp_udp_recv_core
2021-09-22 12:26:41 +02:00
llc: only change llc->dev when bind() succeeds
2022-03-28 08:46:48 +02:00
mac80211: fix potential double free on mesh join
2022-03-28 08:46:48 +02:00
net: mpls: Fix notifications when deleting a device
2021-12-08 09:01:12 +01:00
net/ncsi: check for error return from call to nla_put_u32
2022-01-05 12:37:45 +01:00
netfilter: nf_conntrack_tcp: preserve liberal flag in tcp options
2022-04-15 14:18:20 +02:00
net: fix NULL pointer reference in cipso_v4_doi_free
2021-09-22 12:26:36 +02:00
af_netlink: Fix shift out of bounds in group mask calculation
2022-04-15 14:18:16 +02:00
netrom: Decrease sock refcount when sock timers expire
2021-07-28 13:30:56 +02:00
nfc: llcp: fix NULL error pointer dereference on sendmsg() after failed bind()
2022-01-27 09:19:26 +01:00
openvswitch: always update flow key after nat
2022-04-15 14:18:17 +02:00
net/packet: fix slab-out-of-bounds access in packet_recvmsg()
2022-03-23 09:12:06 +01:00
phonet: refcount leak in pep_sock_accep
2022-01-11 15:23:33 +01:00
net: qrtr: fix another OOB Read in qrtr_endpoint_post
2021-09-03 10:08:12 +02:00
rds: memory leak in __rds_conn_create()
2021-12-22 09:29:37 +01:00
rxrpc: Adjust retransmission backoff
2022-02-01 17:24:38 +01:00
net: sched: limit TC_ACT_REPEAT loops
2022-02-23 11:59:59 +01:00
sctp: fix the processing for INIT chunk
2022-03-19 13:40:13 +01:00
net/smc: fix unexpected SMC_CLC_DECL_ERR_REGRMB error cause by server
2022-03-08 19:07:47 +01:00
bpf: sockmap, strparser, and tls are reusing qdisc_skb_cb and colliding
2021-11-17 09:48:48 +01:00
SUNRPC: avoid race between mod_timer() and del_timer_sync()
2022-04-15 14:17:58 +02:00
net: switchdev: do not propagate bridge updates across bridges
2021-10-27 09:54:24 +02:00
tipc: fix the timer expires after interval 100ms
2022-04-15 14:18:17 +02:00
net/tls: Fix authentication failure in CCM mode
2021-12-08 09:01:14 +01:00
af_unix: annote lockless accesses to unix_tot_inflight & gc_in_progress
2022-01-27 09:19:53 +01:00
vsock: remove vsock from connected table when connect is interrupted by a signal
2022-02-23 11:59:57 +01:00
nl80211: Update bss channel on channel switch for P2P_CLIENT
2022-03-19 13:40:17 +01:00
net/x25: Fix null-ptr-deref caused by x25_disconnect
2022-04-15 14:18:21 +02:00
Revert "xsk: Do not sleep in poll() when need_wakeup set"
2021-12-22 09:29:40 +01:00
xfrm: fix tunnel model fragmentation behavior
2022-04-15 14:17:56 +02:00
net: don't unconditionally copy_from_user a struct ifreq for socket ioctls
2021-09-03 10:08:16 +02:00
9acf05b4e7