Fedor Pchelkin
71349abe3a
nfc: nci: free rx_data_reassembly skb on NCI device cleanup ...
commit bfb007aebe6bff451f7f3a4be19f4f286d0d5d9c upstream.
rx_data_reassembly skb is stored during NCI data exchange for processing
fragmented packets. It is dropped only when the last fragment is processed
or when an NTF packet with NCI_OP_RF_DEACTIVATE_NTF opcode is received.
However, the NCI device may be deallocated before that which leads to skb
leak.
As by design the rx_data_reassembly skb is bound to the NCI device and
nothing prevents the device to be freed before the skb is processed in
some way and cleaned, free it on the NCI device cleanup.
Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
Fixes: 6a2968aaf5stable@vger.kernel.org
Reported-by: syzbot+6b7c68d9c21e4ee4251b@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/lkml/000000000000f43987060043da7b@google.com/
Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2024-02-23 08:25:11 +01:00
net: 9p: avoid freeing uninit memory in p9pdu_vreadf
2024-01-08 11:29:47 +01:00
vlan: skip nested type that is not IFLA_VLAN_QOS_MAPPING
2024-02-23 08:24:50 +01:00
appletalk: Fix Use-After-Free in atalk_ioctl
2023-12-20 15:41:18 +01:00
atm: Fix Use-After-Free in do_vcc_ioctl
2023-12-20 15:41:15 +01:00
batman-adv: Hold rtnl lock during MTU update via netlink
2023-08-30 16:27:25 +02:00
Bluetooth: Fix bogus check for re-auth no supported with non-ssp
2024-01-25 14:34:26 -08:00
netfilter: nf_conntrack_bridge: initialize err to 0
2023-11-28 16:50:17 +00:00
can: raw: add support for SO_MARK
2024-01-15 18:25:25 +01:00
libceph: use kernel_connect()
2023-10-25 11:53:19 +02:00
neighbour: Don't let neigh_forced_gc() disable preemption for long
2024-01-25 14:34:20 -08:00
dccp/tcp: Call security_inet_conn_request() after setting IPv6 addresses.
2023-11-20 10:30:15 +01:00
net: sched: ife: fix potential use-after-free
2024-01-08 11:29:44 +01:00
inet: read sk->sk_family once in inet_recv_error()
2024-02-23 08:25:07 +01:00
ipv6: Ensure natural alignment of const ipv6 loopback and router addresses
2024-02-23 08:25:04 +01:00
net/af_iucv: clean up a try_then_request_module()
2024-02-23 08:25:07 +01:00
kcm: Fix error handling for SOCK_DGRAM in kcm_sendmsg().
2023-09-23 11:00:02 +02:00
net: af_key: fix sadb_x_filter validation
2023-08-30 16:27:16 +02:00
ipv4, ipv6: Fix handling of transhdrlen in __ip{,6}_append_data()
2023-10-10 21:46:44 +02:00
llc: call sock_orphan() at release time
2024-02-23 08:25:04 +01:00
wifi: mac80211: mesh_plink: fix matches_local logic
2024-01-08 11:29:43 +01:00
net/ncsi: Fix netlink major/minor version numbers
2024-01-25 14:34:25 -08:00
netfilter: nft_set_rbtree: skip end interval element from gc
2024-02-23 08:25:08 +01:00
calipso: fix memory leak in netlbl_calipso_add_pass()
2024-01-25 14:34:23 -08:00
netlink: fix potential sleeping issue in mqueue_flush_file
2024-02-23 08:24:50 +01:00
netrom: Deny concurrent connect().
2023-09-23 10:59:43 +02:00
nfc: nci: free rx_data_reassembly skb on NCI device cleanup
2024-02-23 08:25:11 +01:00
packet: Move reference count in packet_sock to atomic_long_t
2023-12-13 18:18:14 +01:00
psample: Require 'CAP_NET_ADMIN' when joining "packets" group
2023-12-13 18:18:17 +01:00
net/rds: Fix UBSAN: array-index-out-of-bounds in rds_cmsg_recv
2024-02-23 08:24:50 +01:00
net: rfkill: gpio: set GPIO direction
2024-01-08 11:29:47 +01:00
net/rose: fix races in rose_kill_by_device()
2024-01-08 11:29:44 +01:00
rxrpc: Fix response to PING RESPONSE ACKs to a dead call
2024-02-23 08:25:07 +01:00
net: sched: em_text: fix possible memory leak in em_text_destroy()
2024-01-15 18:25:25 +01:00
sctp: update hb timer immediately after users change hb_interval
2023-10-10 21:46:45 +02:00
net/smc: fix illegal rmb_desc access in SMC-D connection dump
2024-02-23 08:24:50 +01:00
SUNRPC: Fix a suspicious RCU usage warning
2024-02-23 08:24:56 +01:00
tipc: Check the bearer type before calling tipc_udp_nl_bearer_add()
2024-02-23 08:25:07 +01:00
net: tls, update curr on splice as well
2024-01-15 18:25:29 +01:00
af_unix: fix lockdep positive in sk_diag_dump_icons()
2024-02-23 08:25:05 +01:00
virtio/vsock: fix logic which reduces credit update messages
2024-01-25 14:34:25 -08:00
wifi: cfg80211: fix RCU dereference in __cfg80211_bss_update
2024-02-23 08:25:03 +01:00
xfrm: interface: use DEV_STATS_INC()
2023-10-25 11:53:21 +02:00
net: Save and restore msg_namelen in sock_sendmsg
2024-01-15 18:25:26 +01:00
71349abe3a