Pablo Neira Ayuso
c8b6063f13
netfilter: nf_tables: deactivate anonymous set from preparation phase ...
commit c1592a89942e9678f7d9c8030efa777c0d57edab upstream.
Toggle deleted anonymous sets as inactive in the next generation, so
users cannot perform any update on it. Clear the generation bitmask
in case the transaction is aborted.
The following KASAN splat shows a set element deletion for a bound
anonymous set that has been already removed in the same transaction.
[ 64.921510] ==================================================================
[ 64.923123] BUG: KASAN: wild-memory-access in nf_tables_commit+0xa24/0x1490 [nf_tables]
[ 64.924745] Write of size 8 at addr dead000000000122 by task test/890
[ 64.927903] CPU: 3 PID: 890 Comm: test Not tainted 6.3.0+ #253
[ 64.931120] Call Trace:
[ 64.932699] <TASK>
[ 64.934292] dump_stack_lvl+0x33/0x50
[ 64.935908] ? nf_tables_commit+0xa24/0x1490 [nf_tables]
[ 64.937551] kasan_report+0xda/0x120
[ 64.939186] ? nf_tables_commit+0xa24/0x1490 [nf_tables]
[ 64.940814] nf_tables_commit+0xa24/0x1490 [nf_tables]
[ 64.942452] ? __kasan_slab_alloc+0x2d/0x60
[ 64.944070] ? nf_tables_setelem_notify+0x190/0x190 [nf_tables]
[ 64.945710] ? kasan_set_track+0x21/0x30
[ 64.947323] nfnetlink_rcv_batch+0x709/0xd90 [nfnetlink]
[ 64.948898] ? nfnetlink_rcv_msg+0x480/0x480 [nfnetlink]
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-05-17 11:35:57 +02:00
Bluetooth: L2CAP: Fix use-after-free caused by l2cap_chan_put
2022-08-03 11:59:37 +02:00
net: caif: add proper error handling
2021-06-10 13:37:09 +02:00
netfilter: nf_tables: deactivate anonymous set from preparation phase
2023-05-17 11:35:57 +02:00
ipv4: convert fib_num_tclassid_users to atomic_t
2021-12-08 09:01:12 +01:00
NFC: add NCI_UNREG flag to eliminate the race
2021-12-01 09:23:35 +01:00
sctp: add a refcnt in sctp_stream_priorities to avoid a nested loop
2023-03-11 16:44:11 +01:00
net/sched: act_pedit: really ensure the skb is writable
2022-05-18 09:47:25 +02:00
net: sched: fix police ext initialization
2021-03-04 10:26:53 +01:00
ipv6/addrconf: fix a null-ptr-deref bug for ip6_ptr
2022-08-03 11:59:39 +02:00
ipv4: Invalidate neighbour for broadcast address upon address addition
2022-04-15 14:18:33 +02:00
ax25: fix reference count leaks of ax25_dev
2022-04-20 09:19:39 +02:00
bonding: fix data-races around agg_select_timer
2022-02-23 11:59:58 +01:00
bonding: make tx_rebalance_counter an atomic
2021-12-14 14:49:00 +01:00
bonding: Rename slave_arr to usable_slaves
2023-01-18 11:41:05 +01:00
net: Fix a data-race around sysctl_net_busy_poll.
2022-09-05 10:27:42 +02:00
mac80211: properly handle A-MSDUs that start with an RFC 1042 header
2021-06-03 08:59:01 +02:00
net: Force inlining of checksum functions in net/checksum.h
2022-03-02 11:41:08 +01:00
net: add atomic_long_t to net_device_stats fields
2023-01-18 11:41:37 +01:00
net: fix a memleak when uncloning an skb dst and its metadata
2022-02-16 12:52:51 +01:00
esp: limit skb_page_frag_refill use to a single page
2022-07-12 16:30:45 +02:00
ipv6: fix memory leak in fib6_rule_suppress
2021-12-08 09:01:13 +01:00
net/sched: flower: fix parsing of ethertype following VLAN header
2022-04-20 09:19:34 +02:00
net: icmp: pass zeroed opts from icmp{,v6}_ndo_send before sending
2021-03-04 10:26:53 +01:00
net: ieee802154: return -EINVAL for unknown addr type
2022-10-26 13:22:59 +02:00
ipv6: fix locking issues with loops over idev->addr_list
2022-06-14 18:11:25 +02:00
tcp: relookup sock for RST+ACK packets handled by obsolete req sock
2021-03-30 14:35:26 +02:00
inet_ecn: Fix endianness of checksum update when setting ECT(1)
2020-12-08 10:40:25 +01:00
inet: frags: annotate races around fqdir->dead and fqdir->high_thresh
2022-01-27 09:19:54 +01:00
secure_seq: use the 64 bits of the siphash for port offset calculation
2022-06-06 08:33:49 +02:00
tcp/dccp: Fix a data-race around sysctl_tcp_fwmark_accept.
2022-07-29 17:14:11 +02:00
ip: Fix a data-race around sysctl_fwmark_reflect.
2022-07-29 17:14:11 +02:00
ipv6: annotate accesses to fn->fn_sernum
2022-02-01 17:24:38 +01:00
net: ipv6: fix returned variable type in ip6_skb_dst_mtu
2021-08-12 13:20:57 +02:00
ipv4: convert fib_num_tclassid_users to atomic_t
2021-12-08 09:01:12 +01:00
ip_tunnels: Set tunnel option flag when tunnel metadata is present
2020-11-24 13:29:05 +01:00
tcp/udp: Call inet6_destroy_sock() in IPv6 sk->sk_destruct().
2023-04-26 11:24:05 +02:00
inet: frags: annotate races around fqdir->dead and fqdir->high_thresh
2022-01-27 09:19:54 +01:00
net: ipv6: add fib6_nh_release_dsts stub
2021-12-01 09:23:33 +01:00
llc: fix out-of-bound array index in llc_sk_dev_hash()
2021-11-17 09:48:47 +01:00
net: llc: fix skb_over_panic
2021-08-04 12:27:39 +02:00
mrp: introduce active flags to prevent UAF when applicant uninit
2023-01-18 11:41:37 +01:00
net, neigh: Enable state migration between NUD_PERMANENT and NTF_USE
2021-11-17 09:48:49 +01:00
net: make get_net_ns return error if NET_NS is disabled
2021-06-23 14:41:25 +02:00
net: ipv4: Fix rtnexthop len when RTA_FLOW is present
2021-10-06 15:42:33 +02:00
net: ieee802154: handle iftypes as u32
2021-12-01 09:23:32 +01:00
mm: fix struct page layout on 32-bit systems
2021-05-19 10:08:31 +02:00
net: prevent user from passing illegal stab size
2021-10-17 10:42:34 +02:00
tcp/udp: Make early_demux back namespacified.
2022-11-10 17:57:55 +01:00
psample: Add a fwd declaration for skbuff
2021-08-18 08:56:59 +02:00
raw: Fix a data-race around sysctl_raw_l3mdev_accept.
2022-07-21 20:59:22 +02:00
sch_red: fix off-by-one checks in red_check_params()
2021-04-14 08:24:14 +02:00
ipv4: remove sparse error in ip_neigh_gw4()
2022-02-01 17:24:39 +01:00
can: dev: Move device back to init netns on owning netns delete
2021-03-30 14:35:29 +02:00
net/sched: sch_taprio: fix possible use-after-free
2023-02-06 07:52:37 +01:00
scm: fix MSG_CTRUNC setting condition for SO_PASSSEC
2023-05-17 11:35:41 +02:00
secure_seq: use the 64 bits of the siphash for port offset calculation
2022-06-06 08:33:49 +02:00
net: add sock_init_data_uid()
2023-03-11 16:43:40 +01:00
bpf: sockmap, strparser, and tls are reusing qdisc_skb_cb and colliding
2021-11-17 09:48:48 +01:00
tcp/udp: Make early_demux back namespacified.
2022-11-10 17:57:55 +01:00
net/tls: Fix flipped sign in tls_err_abort() calls
2021-11-02 19:46:12 +01:00
tcp/udp: Call inet6_destroy_sock() in IPv6 sk->sk_destruct().
2023-04-26 11:24:05 +02:00
udp: call udp_encap_enable for v6 sockets when enabling encap
2022-04-15 14:18:01 +02:00
tcp/udp: Call inet6_destroy_sock() in IPv6 sk->sk_destruct().
2023-04-26 11:24:05 +02:00
xfrm: Check if_id in xfrm_migrate
2022-03-19 13:40:16 +01:00
c8b6063f13