Repository files (latest commit first)

Filename	Latest commit message	Latest commit date
Ilya Dryomov 63e5d035e3 libceph: fix race between delayed_work() and ceph_monc_stop() ... commit 69c7b2fe4c9cc1d3b1186d1c5606627ecf0de883 upstream. The way the delayed work is handled in ceph_monc_stop() is prone to races with mon_fault() and possibly also finish_hunting(). Both of these can requeue the delayed work which wouldn't be canceled by any of the following code in case that happens after cancel_delayed_work_sync() runs -- __close_session() doesn't mess with the delayed work in order to avoid interfering with the hunting interval logic. This part was missed in commit b5d91704f5 ("libceph: behave in mon_fault() if cur_mon < 0") and use-after-free can still ensue on monc and objects that hang off of it, with monc->auth and monc->monmap being particularly susceptible to quickly being reused. To fix this: - clear monc->cur_mon and monc->hunting as part of closing the session in ceph_monc_stop() - bail from delayed_work() if monc->cur_mon is cleared, similar to how it's done in mon_fault() and finish_hunting() (based on monc->hunting) - call cancel_delayed_work_sync() after the session is closed Cc: stable@vger.kernel.org Link: https://tracker.ceph.com/issues/66857 Signed-off-by: Ilya Dryomov <idryomov@gmail.com> Reviewed-by: Xiubo Li <xiubli@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2024-07-18 11:40:55 +02:00
..
6lowpan
9p	net/9p: fix uninit-value in p9_client_rpc()	2024-06-16 13:28:51 +02:00
802
8021q	vlan: skip nested type that is not IFLA_VLAN_QOS_MAPPING	2024-02-23 08:24:50 +01:00
appletalk
atm
ax25
batman-adv	batman-adv: Don't accept TT entries for out-of-spec VIDs	2024-07-05 09:08:31 +02:00
bluetooth	Bluetooth: L2CAP: Fix rejecting L2CAP_CONN_PARAM_UPDATE_REQ	2024-07-05 09:08:17 +02:00
bpf
bpfilter
bridge	net: bridge: fix corrupted ethernet header on multicast-to-unicast	2024-05-17 11:43:54 +02:00
caif
can	net: can: j1939: enhanced error handling for tightly received RTS messages in xtp_rx_rts_session_new	2024-07-05 09:08:30 +02:00
ceph	libceph: fix race between delayed_work() and ceph_monc_stop()	2024-07-18 11:40:55 +02:00
core	ipv6: Fix data races around sk->sk_prot.	2024-07-05 09:08:32 +02:00
dcb
dccp
decnet
dns_resolver
dsa
ethernet	ethernet: Add helper for assigning packet type when dest address does not match device address	2024-05-02 16:18:36 +02:00
hsr	hsr: Handle failures in module init	2024-03-26 18:22:25 -04:00
ieee802154
ife
ipv4	udp: Set SOCK_RCU_FREE earlier in udp_lib_get_port().	2024-07-18 11:40:53 +02:00
ipv6	tcp: Fix data races around icsk->icsk_af_ops.	2024-07-05 09:08:32 +02:00
iucv	net/iucv: Avoid explicit cpumask var allocation on stack	2024-07-05 09:08:28 +02:00
kcm	net: kcm: fix incorrect parameter validation in the kcm_getsockopt) function	2024-03-26 18:22:18 -04:00
key
l2tp	net l2tp: drop flow hash on forward	2024-05-17 11:43:49 +02:00
l3mdev
lapb
llc	llc: call sock_orphan() at release time	2024-02-23 08:25:04 +01:00
mac80211	wifi: mac80211: Fix deadlock in ieee80211_sta_ps_deliver_wakeup()	2024-07-05 09:08:10 +02:00
mac802154
mpls
ncsi	net/ncsi: Fix netlink major/minor version numbers	2024-01-25 14:34:25 -08:00
netfilter	netfilter: nf_tables: fully validate NFT_DATA_VALUE on store to data registers	2024-07-05 09:08:27 +02:00
netlabel	calipso: fix memory leak in netlbl_calipso_add_pass()	2024-01-25 14:34:23 -08:00
netlink	netlink: Fix kernel-infoleak-after-free in __skb_datagram_iter	2024-03-06 14:36:08 +00:00
netrom	netrom: Fix a memory leak in nr_heartbeat_expiry()	2024-07-05 09:08:22 +02:00
nfc	nfc: nci: Fix handling of zero-length payload packets in nci_rx_work()	2024-06-16 13:28:46 +02:00
nsh	nsh: Restore skb->{protocol,data,mac_header} for outer header in nsh_gso_segment().	2024-05-17 11:43:49 +02:00
openvswitch	openvswitch: Set the skbuff pkt_type for proper pmtud support.	2024-06-16 13:28:45 +02:00
packet	af_packet: do not call packet_read_pending() from tpacket_destruct_skb()	2024-06-16 13:28:40 +02:00
phonet	phonet: fix rtm_phonet_notify() skb allocation	2024-05-17 11:43:54 +02:00
psample
qrtr
rds	net/rds: fix possible cp null dereference	2024-04-13 12:51:33 +02:00
rfkill	net: rfkill: gpio: set GPIO direction	2024-01-08 11:29:47 +01:00
rose
rxrpc	rxrpc: Fix response to PING RESPONSE ACKs to a dead call	2024-02-23 08:25:07 +01:00
sched	net/sched: act_api: fix possible infinite loop in tcf_idr_check_alloc()	2024-07-05 09:08:23 +02:00
sctp	sctp: prefer struct_size over open coded arithmetic	2024-07-18 11:40:48 +02:00
smc	net/smc: fix illegal rmb_desc access in SMC-D connection dump	2024-02-23 08:24:50 +01:00
strparser
sunrpc	SUNRPC: return proper error from gss_wrap_req_priv	2024-07-05 09:08:16 +02:00
switchdev
tipc	tipc: fix UAF in error path	2024-05-17 11:43:55 +02:00
tls	tls: stop recv() if initial process_rx_list gave us non-DATA	2024-03-01 13:13:37 +01:00
unix	af_unix: Annotate data-race of sk->sk_shutdown in sk_diag_fill().	2024-07-05 09:08:12 +02:00
vmw_vsock	virtio/vsock: fix logic which reduces credit update messages	2024-01-25 14:34:25 -08:00
wimax
wireless	wifi: cfg80211: pmsr: use correct nla_get_uX functions	2024-07-05 09:08:10 +02:00
x25	net/x25: fix incorrect parameter validation in the x25_getsockopt() function	2024-03-26 18:22:18 -04:00
xdp	xsk: validate user input for XDP_{UMEM|COMPLETION}_FILL_RING	2024-06-16 13:28:52 +02:00
xfrm	net: fix __dst_negative_advice() race	2024-06-16 13:28:52 +02:00
compat.c
Kconfig
Makefile
socket.c	net: Save and restore msg_namelen in sock_sendmsg	2024-01-15 18:25:26 +01:00
sysctl_net.c