Kadlecsik József
8ce07d95d6
netfilter: ipset: fix suspicious RCU usage in find_set_and_id ...
commit 5038517119d50ed0240059b1d7fc2faa92371c08 upstream.
find_set_and_id() is called when the NFNL_SUBSYS_IPSET mutex is held.
However, in the error path there can be a follow-up recvmsg() without
the mutex held. Use the start() function of struct netlink_dump_control
instead of dump() to verify and report if the specified set does not
exist.
Thanks to Pablo Neira Ayuso for helping me to understand the subleties
of the netlink protocol.
Reported-by: syzbot+fc69d7cb21258ab4ae4d@syzkaller.appspotmail.com
Signed-off-by: Jozsef Kadlecsik <kadlec@netfilter.org>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-02-11 04:35:07 -08:00
vlan: vlan_changelink() should propagate errors
2020-01-12 12:21:50 +01:00
net: atm: Reduce the severity of logging in unlink_clip_vcc
2019-11-18 17:08:20 -08:00
batman-adv: Fix DAT candidate selection on little endian systems
2020-01-23 08:22:49 +01:00
Bluetooth: Fix race condition in hci_release_sock()
2020-02-05 21:22:42 +00:00
net: add bool confirm_neigh parameter for dst_ops.update_pmtu
2020-01-04 19:18:58 +01:00
net: use skb_queue_empty_lockless() in poll() handlers
2019-10-28 13:33:41 -07:00
can: j1939: j1939_sk_bind(): take priv after lock is held
2019-12-31 16:45:56 +01:00
flow_dissector: Fix to use new variables for port ranges in bpf hook
2020-02-05 21:22:52 +00:00
net: ipv6: add net argument to ip6_dst_lookup_flow
2019-12-18 16:08:40 +01:00
net: add bool confirm_neigh parameter for dst_ops.update_pmtu
2020-01-04 19:18:58 +01:00
net: dsa: tag_gswip: fix typo in tagger name
2020-01-23 08:22:52 +01:00
net: add annotations on hh->hh_len lockless accesses
2020-01-09 10:20:06 +01:00
net: hsr: fix possible NULL deref in hsr_handle_frame()
2020-02-11 04:35:04 -08:00
net: core: add generic lockdep keys
2019-10-24 14:53:48 -07:00
tcp: clear tp->segs_{in|out} in tcp_disconnect()
2020-02-11 04:35:06 -08:00
vti[6]: fix packet tx through bpf_redirect()
2020-02-05 21:22:48 +00:00
l2tp: Allow duplicate session creation with UDP
2020-02-11 04:35:04 -08:00
llc2: Fix return statement of llc_stat_ev_rx_null_dsap_xid_c (and _test_c)
2020-01-12 12:21:45 +01:00
mac80211: Fix TKIP replay protection immediately after key setup
2020-02-05 21:22:46 +00:00
net: ipv6_stub: use ip6_dst_lookup_flow instead of ip6_dst_lookup
2019-12-18 16:08:42 +01:00
netfilter: ipset: fix suspicious RCU usage in find_set_and_id
2020-02-11 04:35:07 -08:00
net: core: add generic lockdep keys
2019-10-24 14:53:48 -07:00
net: nfc: nci: fix a possible sleep-in-atomic-context bug in nci_uart_tty_receive()
2019-12-31 16:41:23 +01:00
net: openvswitch: don't unlock mutex when changing the user_features fails
2020-01-26 10:01:05 +01:00
packet: fix data-race in fanout_flow_is_huge()
2020-01-26 10:01:06 +01:00
net: use skb_queue_empty_lockless() in poll() handlers
2019-10-28 13:33:41 -07:00
net: psample: fix skb_over_panic
2019-12-04 22:30:54 +01:00
rds: ib: update WR sizes when bringing up connection
2019-11-16 12:59:08 -08:00
rfkill: Fix incorrect check to avoid NULL pointer dereference
2020-01-12 12:21:33 +01:00
net: core: add generic lockdep keys
2019-10-24 14:53:48 -07:00
rxrpc: Fix NULL pointer deref due to call->conn being cleared on disconnect
2020-02-11 04:35:05 -08:00
net_sched: fix an OOB access in cls_tcindex
2020-02-11 04:35:04 -08:00
sctp: free cmd->obj.chunk for the unprocessed SCTP_CMD_REPLY
2020-01-12 12:21:48 +01:00
net/smc: add fallback check to connect()
2020-01-04 19:18:37 +01:00
SUNRPC: Fix another issue with MIC buffer space
2020-01-26 10:01:07 +01:00
tipc: fix wrong timeout input for tipc_wait_for_cond()
2020-01-26 10:01:00 +01:00
net/tls: fix async operation
2020-01-29 16:45:28 +01:00
af_unix: add compat_ioctl support
2020-01-17 19:48:52 +01:00
vsock/virtio: fix sock refcnt holding during the shutdown
2019-11-08 12:17:50 -08:00
wireless: wext: avoid gcc -O3 warning
2020-02-05 21:22:47 +00:00
net/x25: fix nonblocking connect
2020-01-29 16:45:33 +01:00
xsk: Add rcu_read_lock around the XSK wakeup
2020-01-12 12:21:41 +01:00
xfrm: interface: do not confirm neighbor when do pmtu update
2020-02-05 21:22:48 +00:00
compat_ioctl: handle SIOCOUTQNSD
2020-01-17 19:48:52 +01:00
8ce07d95d6