Pablo Neira Ayuso
c8b6063f13
netfilter: nf_tables: deactivate anonymous set from preparation phase ...
commit c1592a89942e9678f7d9c8030efa777c0d57edab upstream.
Toggle deleted anonymous sets as inactive in the next generation, so
users cannot perform any update on it. Clear the generation bitmask
in case the transaction is aborted.
The following KASAN splat shows a set element deletion for a bound
anonymous set that has been already removed in the same transaction.
[ 64.921510] ==================================================================
[ 64.923123] BUG: KASAN: wild-memory-access in nf_tables_commit+0xa24/0x1490 [nf_tables]
[ 64.924745] Write of size 8 at addr dead000000000122 by task test/890
[ 64.927903] CPU: 3 PID: 890 Comm: test Not tainted 6.3.0+ #253
[ 64.931120] Call Trace:
[ 64.932699] <TASK>
[ 64.934292] dump_stack_lvl+0x33/0x50
[ 64.935908] ? nf_tables_commit+0xa24/0x1490 [nf_tables]
[ 64.937551] kasan_report+0xda/0x120
[ 64.939186] ? nf_tables_commit+0xa24/0x1490 [nf_tables]
[ 64.940814] nf_tables_commit+0xa24/0x1490 [nf_tables]
[ 64.942452] ? __kasan_slab_alloc+0x2d/0x60
[ 64.944070] ? nf_tables_setelem_notify+0x190/0x190 [nf_tables]
[ 64.945710] ? kasan_set_track+0x21/0x30
[ 64.947323] nfnetlink_rcv_batch+0x709/0xd90 [nfnetlink]
[ 64.948898] ? nfnetlink_rcv_msg+0x480/0x480 [nfnetlink]
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-05-17 11:35:57 +02:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 188
2019-05-30 11:29:21 -07:00
Bluetooth: L2CAP: Fix use-after-free caused by l2cap_chan_put
2022-08-03 11:59:37 +02:00
net: caif: add proper error handling
2021-06-10 13:37:09 +02:00
netfilter: nf_tables: deactivate anonymous set from preparation phase
2023-05-17 11:35:57 +02:00
ipv4: convert fib_num_tclassid_users to atomic_t
2021-12-08 09:01:12 +01:00
NFC: add NCI_UNREG flag to eliminate the race
2021-12-01 09:23:35 +01:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 336
2019-06-05 17:37:07 +02:00
sctp: add a refcnt in sctp_stream_priorities to avoid a nested loop
2023-03-11 16:44:11 +01:00
net/sched: act_pedit: really ensure the skb is writable
2022-05-18 09:47:25 +02:00
net: sched: fix police ext initialization
2021-03-04 10:26:53 +01:00
ipv6/addrconf: fix a null-ptr-deref bug for ip6_ptr
2022-08-03 11:59:39 +02:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 174
2019-05-30 11:26:41 -07:00
rxrpc: Make rxrpc_kernel_get_srtt() indicate validity
2020-09-09 19:12:23 +02:00
net: split out functions related to registering inflight socket files
2019-02-28 08:24:23 -07:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 321
2019-06-05 17:37:05 +02:00
ipv4: Invalidate neighbour for broadcast address upon address addition
2022-04-15 14:18:33 +02:00
ax25: fix reference count leaks of ax25_dev
2022-04-20 09:19:39 +02:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500
2019-06-19 17:09:55 +02:00
bonding: fix data-races around agg_select_timer
2022-02-23 11:59:58 +01:00
bonding: make tx_rebalance_counter an atomic
2021-12-14 14:49:00 +01:00
bonding: add an option to specify a delay between peer notifications
2019-07-04 12:30:48 -07:00
bonding: Rename slave_arr to usable_slaves
2023-01-18 11:41:05 +01:00
bpf: support cloning sk storage on accept()
2019-08-17 23:18:54 +02:00
net: Fix a data-race around sysctl_net_busy_poll.
2022-09-05 10:27:42 +02:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 13
2019-05-21 11:28:45 +02:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500
2019-06-19 17:09:55 +02:00
mac80211: properly handle A-MSDUs that start with an RFC 1042 header
2021-06-03 08:59:01 +02:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 174
2019-05-30 11:26:41 -07:00
net: Force inlining of checksum functions in net/checksum.h
2022-03-02 11:41:08 +01:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 13
2019-05-21 11:28:45 +02:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
net: rework SIOCGSTAMP ioctl handling
2019-04-19 14:07:40 -07:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 201
2019-05-30 11:29:52 -07:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 201
2019-05-30 11:29:52 -07:00
devlink: disallow reload operation during device cleanup
2019-11-09 19:38:36 -08:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 24
2019-05-21 11:52:39 +02:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 24
2019-05-21 11:52:39 +02:00
net: drop_monitor: use IS_REACHABLE() to guard net_dm_hw_report()
2020-05-27 17:46:24 +02:00
net: dsa: Pass ndo_setup_tc slave callback to drivers
2019-09-16 21:32:57 +02:00
net: add atomic_long_t to net_device_stats fields
2023-01-18 11:41:37 +01:00
net: fix a memleak when uncloning an skb dst and its metadata
2022-02-16 12:52:51 +01:00
net: add bool confirm_neigh parameter for dst_ops.update_pmtu
2020-01-04 19:18:58 +01:00
esp: limit skb_page_frag_refill use to a single page
2022-07-12 16:30:45 +02:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500
2019-06-19 17:09:55 +02:00
net: fib: drop include of module.h from fib_notifier.h
2019-04-22 21:50:53 -07:00
ipv6: fix memory leak in fib6_rule_suppress
2021-12-08 09:01:13 +01:00
ipv4: Initialize flowi4_multipath_hash in data path
2020-09-26 18:03:12 +02:00
net/sched: flower: fix parsing of ethertype following VLAN header
2022-04-20 09:19:34 +02:00
net: core: rename indirect block ingress cb function
2019-12-18 16:08:47 +01:00
net/flow_dissector: switch to siphash
2019-10-23 20:13:22 -07:00
net/fq_impl: Switch to kvmalloc() for memory allocation
2019-11-08 09:11:49 +01:00
genetlink: remove genl_bind
2020-07-22 09:32:46 +02:00
net: Move the definition of the default Geneve udp port to public header file
2019-03-22 12:09:31 -07:00
net:gue.h:Fix shifting signed 32-bit value by 31 bits problem
2019-07-01 10:58:23 -07:00
net: hwbm: if CONFIG_NET_HWBM unset, make stub functions static
2019-10-25 16:24:32 -07:00
net: icmp: pass zeroed opts from icmp{,v6}_ndo_send before sending
2021-03-04 10:26:53 +01:00
wireless-drivers-next patches for 5.1
2019-02-22 12:56:24 -08:00
net: ieee802154: return -EINVAL for unknown addr type
2022-10-26 13:22:59 +02:00
ipv6: fix locking issues with loops over idev->addr_list
2022-06-14 18:11:25 +02:00
net: ife: drop include of module.h from net/ife.h
2019-04-22 21:50:53 -07:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
inet: factor out inet_send_prepare()
2019-07-03 13:51:54 -07:00
tcp: relookup sock for RST+ACK packets handled by obsolete req sock
2021-03-30 14:35:26 +02:00
inet_ecn: Fix endianness of checksum update when setting ECT(1)
2020-12-08 10:40:25 +01:00
inet: frags: annotate races around fqdir->dead and fqdir->high_thresh
2022-01-27 09:19:54 +01:00
secure_seq: use the 64 bits of the siphash for port offset calculation
2022-06-06 08:33:49 +02:00
tcp/dccp: Fix a data-race around sysctl_tcp_fwmark_accept.
2022-07-29 17:14:11 +02:00
tcp: honor SO_PRIORITY in TIME_WAIT state
2019-09-27 12:05:02 +02:00
ip: Fix a data-race around sysctl_fwmark_reflect.
2022-07-29 17:14:11 +02:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
ipv6: annotate accesses to fn->fn_sernum
2022-02-01 17:24:38 +01:00
net: ipv6: fix returned variable type in ip6_skb_dst_mtu
2021-08-12 13:20:57 +02:00
ip6_tunnel: allow not to count pkts on tstats by passing dev as NULL
2019-06-18 20:48:45 -04:00
ipv4: convert fib_num_tclassid_users to atomic_t
2021-12-08 09:01:12 +01:00
ip_tunnels: Set tunnel option flag when tunnel metadata is present
2020-11-24 13:29:05 +01:00
ipvs: allow connection reuse for unconfirmed conntrack
2020-08-19 08:16:10 +02:00
tcp/udp: Call inet6_destroy_sock() in IPv6 sk->sk_destruct().
2023-04-26 11:24:05 +02:00
inet: frags: annotate races around fqdir->dead and fqdir->high_thresh
2022-01-27 09:19:54 +01:00
net: ipv6: add fib6_nh_release_dsts stub
2021-12-01 09:23:33 +01:00
bonding/alb: properly access headers in bond_alb_xmit()
2020-02-11 04:35:48 -08:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500
2019-06-19 17:09:55 +02:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
llc: fix out-of-bound array index in llc_sk_dev_hash()
2021-11-17 09:48:47 +01:00
llc: fix sk_buff leak in llc_conn_service()
2019-10-08 13:23:05 -07:00
net: llc: fix skb_over_panic
2021-08-04 12:27:39 +02:00
lwtunnel: Pass encap and encap type attributes to lwtunnel_fill_encap
2019-04-23 19:42:29 -07:00
mac80211: populate debugfs only after cfg80211 init
2020-04-29 16:33:18 +02:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 174
2019-05-30 11:26:41 -07:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 13
2019-05-21 11:28:45 +02:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 295
2019-06-05 17:36:38 +02:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 295
2019-06-05 17:36:38 +02:00
mrp: introduce active flags to prevent UAF when applicant uninit
2023-01-18 11:41:37 +01:00
net: avoid potential false sharing in neighbor related code
2019-12-31 16:45:03 +01:00
net, neigh: Enable state migration between NUD_PERMANENT and NTF_USE
2021-11-17 09:48:49 +01:00
net: make get_net_ns return error if NET_NS is disabled
2021-06-23 14:41:25 +02:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 13
2019-05-21 11:28:45 +02:00
netlink: Fix nlmsg_parse as a wrapper for strict message parsing
2019-08-13 20:37:16 -07:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
net: netrom: Fix error cleanup path of nr_proto_init
2019-04-11 13:59:49 -07:00
net: ipv4: Fix rtnexthop len when RTA_FLOW is present
2021-10-06 15:42:33 +02:00
net: ieee802154: handle iftypes as u32
2021-12-01 09:23:32 +01:00
mm: fix struct page layout on 32-bit systems
2021-05-19 10:08:31 +02:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
net_sched: fix ops->bind_class() implementations
2020-02-01 09:34:38 +00:00
net: prevent user from passing illegal stab size
2021-10-17 10:42:34 +02:00
tcp/udp: Make early_demux back namespacified.
2022-11-10 17:57:55 +01:00
psample: Add a fwd declaration for skbuff
2021-08-18 08:56:59 +02:00
raw: Fix a data-race around sysctl_raw_l3mdev_accept.
2022-07-21 20:59:22 +02:00
sch_red: fix off-by-one checks in red_check_params()
2021-04-14 08:24:14 +02:00
net: add {READ|WRITE}_ONCE() annotations on ->rskq_accept_head
2019-10-09 21:34:31 -07:00
ipv4: remove sparse error in ip_neigh_gw4()
2022-02-01 17:24:39 +01:00
can: dev: Move device back to init netns on owning netns delete
2021-03-30 14:35:29 +02:00
net: Rename net/nexthop.h net/rtnh.h
2019-04-22 21:47:25 -07:00
net/sched: sch_taprio: fix possible use-after-free
2023-02-06 07:52:37 +01:00
scm: fix MSG_CTRUNC setting condition for SO_PASSSEC
2023-05-17 11:35:41 +02:00
secure_seq: use the 64 bits of the siphash for port offset calculation
2022-06-06 08:33:49 +02:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
net/smc: add smcd support to the pnet table
2019-02-21 10:34:37 -08:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
net: add sock_init_data_uid()
2023-03-11 16:43:40 +01:00
udp: correct reuseport selection with connected sockets
2019-09-16 09:02:18 +02:00
bpf: sockmap, strparser, and tls are reusing qdisc_skb_cb and colliding
2021-11-17 09:48:48 +01:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
tcp/udp: Make early_demux back namespacified.
2022-11-10 17:57:55 +01:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
net/tls: Fix flipped sign in tls_err_abort() calls
2021-11-02 19:46:12 +01:00
tcp/udp: Call inet6_destroy_sock() in IPv6 sk->sk_destruct().
2023-04-26 11:24:05 +02:00
udp: call udp_encap_enable for v6 sockets when enabling encap
2022-04-15 14:18:01 +02:00
tcp/udp: Call inet6_destroy_sock() in IPv6 sk->sk_destruct().
2023-04-26 11:24:05 +02:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 321
2019-06-05 17:37:05 +02:00
vxlan: add adjacent link to limit depth level
2019-10-24 14:53:49 -07:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 268
2019-06-05 17:30:29 +02:00
xdp: page_pool related fix to cpumap
2019-06-19 11:23:13 -04:00
page_pool: do not release pool until inflight == 0.
2019-12-18 16:09:07 +01:00
xsk: add support to allow unaligned chunk placement
2019-08-31 01:08:26 +02:00
xfrm: Check if_id in xfrm_migrate
2022-03-19 13:40:16 +01:00
c8b6063f13