Schspa Shi
aadb1507a7
mrp: introduce active flags to prevent UAF when applicant uninit ...
[ Upstream commit ab0377803dafc58f1e22296708c1c28e309414d6 ]
The caller of del_timer_sync must prevent restarting of the timer, If
we have no this synchronization, there is a small probability that the
cancellation will not be successful.
And syzbot report the fellowing crash:
==================================================================
BUG: KASAN: use-after-free in hlist_add_head include/linux/list.h:929 [inline]
BUG: KASAN: use-after-free in enqueue_timer+0x18/0xa4 kernel/time/timer.c:605
Write at addr f9ff000024df6058 by task syz-fuzzer/2256
Pointer tag: [f9], memory tag: [fe]
CPU: 1 PID: 2256 Comm: syz-fuzzer Not tainted 6.1.0-rc5-syzkaller-00008-
ge01d50cbd6ee #0
Hardware name: linux,dummy-virt (DT)
Call trace:
dump_backtrace.part.0+0xe0/0xf0 arch/arm64/kernel/stacktrace.c:156
dump_backtrace arch/arm64/kernel/stacktrace.c:162 [inline]
show_stack+0x18/0x40 arch/arm64/kernel/stacktrace.c:163
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x68/0x84 lib/dump_stack.c:106
print_address_description mm/kasan/report.c:284 [inline]
print_report+0x1a8/0x4a0 mm/kasan/report.c:395
kasan_report+0x94/0xb4 mm/kasan/report.c:495
__do_kernel_fault+0x164/0x1e0 arch/arm64/mm/fault.c:320
do_bad_area arch/arm64/mm/fault.c:473 [inline]
do_tag_check_fault+0x78/0x8c arch/arm64/mm/fault.c:749
do_mem_abort+0x44/0x94 arch/arm64/mm/fault.c:825
el1_abort+0x40/0x60 arch/arm64/kernel/entry-common.c:367
el1h_64_sync_handler+0xd8/0xe4 arch/arm64/kernel/entry-common.c:427
el1h_64_sync+0x64/0x68 arch/arm64/kernel/entry.S:576
hlist_add_head include/linux/list.h:929 [inline]
enqueue_timer+0x18/0xa4 kernel/time/timer.c:605
mod_timer+0x14/0x20 kernel/time/timer.c:1161
mrp_periodic_timer_arm net/802/mrp.c:614 [inline]
mrp_periodic_timer+0xa0/0xc0 net/802/mrp.c:627
call_timer_fn.constprop.0+0x24/0x80 kernel/time/timer.c:1474
expire_timers+0x98/0xc4 kernel/time/timer.c:1519
To fix it, we can introduce a new active flags to make sure the timer will
not restart.
Reported-by: syzbot+6fd64001c20aa99e34a4@syzkaller.appspotmail.com
Signed-off-by: Schspa Shi <schspa@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-01-18 11:41:37 +01:00
Bluetooth: L2CAP: Fix use-after-free caused by l2cap_chan_put
2022-08-03 11:59:37 +02:00
net: caif: add proper error handling
2021-06-10 13:37:09 +02:00
netfilter: conntrack: re-fetch conntrack after insertion
2022-06-06 08:33:50 +02:00
ipv4: convert fib_num_tclassid_users to atomic_t
2021-12-08 09:01:12 +01:00
NFC: add NCI_UNREG flag to eliminate the race
2021-12-01 09:23:35 +01:00
sctp: fix memory leak in sctp_stream_outq_migrate()
2022-12-08 11:23:03 +01:00
net/sched: act_pedit: really ensure the skb is writable
2022-05-18 09:47:25 +02:00
net: sched: fix police ext initialization
2021-03-04 10:26:53 +01:00
ipv6/addrconf: fix a null-ptr-deref bug for ip6_ptr
2022-08-03 11:59:39 +02:00
rxrpc: Make rxrpc_kernel_get_srtt() indicate validity
2020-09-09 19:12:23 +02:00
ipv4: Invalidate neighbour for broadcast address upon address addition
2022-04-15 14:18:33 +02:00
ax25: fix reference count leaks of ax25_dev
2022-04-20 09:19:39 +02:00
bonding: fix data-races around agg_select_timer
2022-02-23 11:59:58 +01:00
bonding: make tx_rebalance_counter an atomic
2021-12-14 14:49:00 +01:00
bonding: add an option to specify a delay between peer notifications
2019-07-04 12:30:48 -07:00
bonding: Rename slave_arr to usable_slaves
2023-01-18 11:41:05 +01:00
bpf: support cloning sk storage on accept()
2019-08-17 23:18:54 +02:00
net: Fix a data-race around sysctl_net_busy_poll.
2022-09-05 10:27:42 +02:00
mac80211: properly handle A-MSDUs that start with an RFC 1042 header
2021-06-03 08:59:01 +02:00
net: Force inlining of checksum functions in net/checksum.h
2022-03-02 11:41:08 +01:00
devlink: disallow reload operation during device cleanup
2019-11-09 19:38:36 -08:00
net: drop_monitor: use IS_REACHABLE() to guard net_dm_hw_report()
2020-05-27 17:46:24 +02:00
net: dsa: Pass ndo_setup_tc slave callback to drivers
2019-09-16 21:32:57 +02:00
net: add atomic_long_t to net_device_stats fields
2023-01-18 11:41:37 +01:00
net: fix a memleak when uncloning an skb dst and its metadata
2022-02-16 12:52:51 +01:00
net: add bool confirm_neigh parameter for dst_ops.update_pmtu
2020-01-04 19:18:58 +01:00
esp: limit skb_page_frag_refill use to a single page
2022-07-12 16:30:45 +02:00
ipv6: fix memory leak in fib6_rule_suppress
2021-12-08 09:01:13 +01:00
ipv4: Initialize flowi4_multipath_hash in data path
2020-09-26 18:03:12 +02:00
net/sched: flower: fix parsing of ethertype following VLAN header
2022-04-20 09:19:34 +02:00
net: core: rename indirect block ingress cb function
2019-12-18 16:08:47 +01:00
net/flow_dissector: switch to siphash
2019-10-23 20:13:22 -07:00
net/fq_impl: Switch to kvmalloc() for memory allocation
2019-11-08 09:11:49 +01:00
genetlink: remove genl_bind
2020-07-22 09:32:46 +02:00
net: hwbm: if CONFIG_NET_HWBM unset, make stub functions static
2019-10-25 16:24:32 -07:00
net: icmp: pass zeroed opts from icmp{,v6}_ndo_send before sending
2021-03-04 10:26:53 +01:00
net: ieee802154: return -EINVAL for unknown addr type
2022-10-26 13:22:59 +02:00
ipv6: fix locking issues with loops over idev->addr_list
2022-06-14 18:11:25 +02:00
inet: factor out inet_send_prepare()
2019-07-03 13:51:54 -07:00
tcp: relookup sock for RST+ACK packets handled by obsolete req sock
2021-03-30 14:35:26 +02:00
inet_ecn: Fix endianness of checksum update when setting ECT(1)
2020-12-08 10:40:25 +01:00
inet: frags: annotate races around fqdir->dead and fqdir->high_thresh
2022-01-27 09:19:54 +01:00
secure_seq: use the 64 bits of the siphash for port offset calculation
2022-06-06 08:33:49 +02:00
tcp/dccp: Fix a data-race around sysctl_tcp_fwmark_accept.
2022-07-29 17:14:11 +02:00
tcp: honor SO_PRIORITY in TIME_WAIT state
2019-09-27 12:05:02 +02:00
ip: Fix a data-race around sysctl_fwmark_reflect.
2022-07-29 17:14:11 +02:00
ipv6: annotate accesses to fn->fn_sernum
2022-02-01 17:24:38 +01:00
net: ipv6: fix returned variable type in ip6_skb_dst_mtu
2021-08-12 13:20:57 +02:00
ipv4: convert fib_num_tclassid_users to atomic_t
2021-12-08 09:01:12 +01:00
ip_tunnels: Set tunnel option flag when tunnel metadata is present
2020-11-24 13:29:05 +01:00
ipvs: allow connection reuse for unconfirmed conntrack
2020-08-19 08:16:10 +02:00
net: ipv6: add net argument to ip6_dst_lookup_flow
2019-12-18 16:08:40 +01:00
inet: frags: annotate races around fqdir->dead and fqdir->high_thresh
2022-01-27 09:19:54 +01:00
net: ipv6: add fib6_nh_release_dsts stub
2021-12-01 09:23:33 +01:00
bonding/alb: properly access headers in bond_alb_xmit()
2020-02-11 04:35:48 -08:00
llc: fix out-of-bound array index in llc_sk_dev_hash()
2021-11-17 09:48:47 +01:00
llc: fix sk_buff leak in llc_conn_service()
2019-10-08 13:23:05 -07:00
net: llc: fix skb_over_panic
2021-08-04 12:27:39 +02:00
mac80211: populate debugfs only after cfg80211 init
2020-04-29 16:33:18 +02:00
mrp: introduce active flags to prevent UAF when applicant uninit
2023-01-18 11:41:37 +01:00
net: avoid potential false sharing in neighbor related code
2019-12-31 16:45:03 +01:00
net, neigh: Enable state migration between NUD_PERMANENT and NTF_USE
2021-11-17 09:48:49 +01:00
net: make get_net_ns return error if NET_NS is disabled
2021-06-23 14:41:25 +02:00
netlink: Fix nlmsg_parse as a wrapper for strict message parsing
2019-08-13 20:37:16 -07:00
net: ipv4: Fix rtnexthop len when RTA_FLOW is present
2021-10-06 15:42:33 +02:00
net: ieee802154: handle iftypes as u32
2021-12-01 09:23:32 +01:00
mm: fix struct page layout on 32-bit systems
2021-05-19 10:08:31 +02:00
net_sched: fix ops->bind_class() implementations
2020-02-01 09:34:38 +00:00
net: prevent user from passing illegal stab size
2021-10-17 10:42:34 +02:00
tcp/udp: Make early_demux back namespacified.
2022-11-10 17:57:55 +01:00
psample: Add a fwd declaration for skbuff
2021-08-18 08:56:59 +02:00
raw: Fix a data-race around sysctl_raw_l3mdev_accept.
2022-07-21 20:59:22 +02:00
sch_red: fix off-by-one checks in red_check_params()
2021-04-14 08:24:14 +02:00
net: add {READ|WRITE}_ONCE() annotations on ->rskq_accept_head
2019-10-09 21:34:31 -07:00
ipv4: remove sparse error in ip_neigh_gw4()
2022-02-01 17:24:39 +01:00
can: dev: Move device back to init netns on owning netns delete
2021-03-30 14:35:29 +02:00
net: sched: add barrier to fix packet stuck problem for lockless qdisc
2022-06-14 18:11:55 +02:00
secure_seq: use the 64 bits of the siphash for port offset calculation
2022-06-06 08:33:49 +02:00
inet: fully convert sk->sk_rx_dst to RCU rules
2022-10-26 13:23:01 +02:00
udp: correct reuseport selection with connected sockets
2019-09-16 09:02:18 +02:00
bpf: sockmap, strparser, and tls are reusing qdisc_skb_cb and colliding
2021-11-17 09:48:48 +01:00
tcp/udp: Make early_demux back namespacified.
2022-11-10 17:57:55 +01:00
net/tls: Fix flipped sign in tls_err_abort() calls
2021-11-02 19:46:12 +01:00
tcp/udp: Make early_demux back namespacified.
2022-11-10 17:57:55 +01:00
udp: call udp_encap_enable for v6 sockets when enabling encap
2022-04-15 14:18:01 +02:00
vxlan: add adjacent link to limit depth level
2019-10-24 14:53:49 -07:00
page_pool: do not release pool until inflight == 0.
2019-12-18 16:09:07 +01:00
xsk: add support to allow unaligned chunk placement
2019-08-31 01:08:26 +02:00
xfrm: Check if_id in xfrm_migrate
2022-03-19 13:40:16 +01:00
aadb1507a7