Ignat Korchagin 798d0642ee net: inet: do not leave a dangling sk pointer in inet_create() ...

[ Upstream commit 9365fa510c6f82e3aa550a09d0c5c6b44dbc78ff ]

sock_init_data() attaches the allocated sk object to the provided sock
object. If inet_create() fails later, the sk object is freed, but the
sock object retains the dangling pointer, which may create use-after-free
later.

Clear the sk pointer in the sock object on error.

Signed-off-by: Ignat Korchagin <ignat@cloudflare.com>
Reviewed-by: Kuniyuki Iwashima <kuniyu@amazon.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Link: https://patch.msgid.link/20241014153808.51894-7-ignat@cloudflare.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Ulrich Hecht <uli@kernel.org>

2025-02-07 03:34:23 +01:00

..

bpfilter

…

netfilter

netfilter: nf_tables: prevent nf_skb_duplicated corruption

2024-11-08 16:19:10 +01:00

af_inet.c

net: inet: do not leave a dangling sk pointer in inet_create()

2025-02-07 03:34:23 +01:00

ah4.c

…

arp.c

ipv4: Invalidate neighbour for broadcast address upon address addition

2022-04-15 14:15:01 +02:00

cipso_ipv4.c

cipso: fix total option length computation

2024-07-05 09:00:27 +02:00

datagram.c

…

devinet.c

ipv4: Check !in_dev earlier for ioctl(SIOCSIFADDR).

2024-11-08 16:19:11 +01:00

esp4_offload.c

xfrm: Linearize the skb after offloading if needed.

2023-06-28 10:15:29 +02:00

esp4.c

net: ipv4: fix return value check in esp_remove_trailer

2023-10-25 11:16:44 +02:00

fib_frontend.c

ipv4: Mask upper DSCP bits and ECN bits in NETLINK_FIB_LOOKUP family

2024-11-08 16:19:12 +01:00

fib_lookup.h

…

fib_notifier.c

…

fib_rules.c

…

fib_semantics.c

…

fib_trie.c

…

fou.c

…

gre_demux.c

erspan: fix version 1 check in gre_parse_header()

2021-01-12 20:10:19 +01:00

gre_offload.c

…

icmp.c

icmp: guard against too small mtu

2023-04-20 12:04:38 +02:00

igmp.c

ipv4: igmp: fix refcnt uaf issue when receiving igmp query packet

2023-12-08 08:43:25 +01:00

inet_connection_sock.c

tcp: properly terminate timers for kernel sockets

2024-04-13 12:50:12 +02:00

inet_diag.c

inet_diag: Initialize pad field in struct inet_diag_req_v2

2024-07-18 11:39:34 +02:00

inet_fragment.c

…

inet_hashtables.c

Revert "tcp: avoid the lookup process failing to get sk in ehash table"

2023-08-11 11:45:26 +02:00

inet_timewait_sock.c

tcp: Fix NEW_SYN_RECV handling in inet_twsk_purge()

2024-05-02 16:17:13 +02:00

inetpeer.c

inetpeer: Fix data-races around sysctl.

2022-07-21 21:09:27 +02:00

ip_forward.c

…

ip_fragment.c

…

ip_gre.c

ipv4: ip_gre: Fix drops of small packets in ipgre_xmit

2024-11-08 16:19:10 +01:00

ip_input.c

tcp/udp: Make early_demux back namespacified.

2022-11-10 17:46:54 +01:00

ip_options.c

…

ip_output.c

net: ipv4: fix a memleak in ip_setup_cork

2024-02-23 08:12:52 +01:00

ip_sockglue.c

ipv{4,6}/raw: fix output xfrm lookup wrt protocol

2023-06-09 10:23:54 +02:00

ip_tunnel_core.c

…

ip_tunnel.c

net: tunnels: annotate lockless accesses to dev->needed_headroom

2023-03-22 13:27:09 +01:00

ip_vti.c

ip_vti: fix potential slab-use-after-free in decode_session6

2023-08-30 16:31:48 +02:00

ipcomp.c

…

ipconfig.c

net: ipconfig: Don't override command-line hostnames or domains

2021-06-30 08:48:13 -04:00

ipip.c

…

ipmr_base.c

…

ipmr.c

ipmr: convert /proc handlers to rcu_read_lock()

2025-02-07 03:34:20 +01:00

Kconfig

tcp: configurable source port perturb table size

2022-12-08 11:18:31 +01:00

Makefile

…

metrics.c

ipv4: prevent potential spectre v1 gadget in ip_metrics_convert()

2023-02-06 07:49:43 +01:00

netfilter.c

netfilter: use actual socket sk rather than skb sk when routing harder

2020-11-18 19:18:44 +01:00

netlink.c

…

ping.c

ping: fix address binding wrt vrf

2022-05-18 09:42:50 +02:00

proc.c

…

protocol.c

…

raw_diag.c

…

raw.c

ipv{4,6}/raw: fix output xfrm lookup wrt protocol

2023-06-09 10:23:54 +02:00

route.c

ipv4: Fix incorrect source address in Record Route option

2024-08-19 05:32:07 +02:00

syncookies.c

tcp: make sure treq->af_specific is initialized

2022-05-12 12:20:25 +02:00

sysctl_net_ipv4.c

tcp/udp: Make early_demux back namespacified.

2022-11-10 17:46:54 +01:00

tcp_bbr.c

tcp_bbr: fix u32 wrap bug in round logic if bbr_init() called after 2B packets

2021-08-26 08:36:39 -04:00

tcp_bic.c

…

tcp_cdg.c

tcp: cdg: allow tcp_cdg_release() to be called multiple times

2022-11-25 17:40:28 +01:00

tcp_cong.c

net: Only allow init netns to set default tcp cong to a restricted algo

2021-05-22 10:59:39 +02:00

tcp_cubic.c

tcp_cubic: fix spurious Hystart ACK train detections for not-cwnd-limited flows

2021-12-01 09:27:43 +01:00

tcp_dctcp.c

tcp: Fix shift-out-of-bounds in dctcp_update_alpha().

2024-06-16 13:23:35 +02:00

tcp_diag.c

tcp: annotate tp->write_seq lockless reads

2021-03-17 16:43:43 +01:00

tcp_fastopen.c

tcp: annotate data-races around fastopenq.max_qlen

2023-08-11 11:45:27 +02:00

tcp_highspeed.c

…

tcp_htcp.c

…

tcp_hybla.c

…

tcp_illinois.c

…

tcp_input.c

tcp: fix tcp_enter_recovery() to zero retrans_stamp when it's safe

2024-11-08 16:19:17 +01:00

tcp_ipv4.c

tcp: avoid reusing FIN_WAIT2 when trying to find port in connect() process

2024-11-08 16:19:12 +01:00

tcp_lp.c

…

tcp_metrics.c

tcp_metrics: validate source addr length

2024-07-18 11:39:34 +02:00

tcp_minisocks.c

tcp: tcp_check_req() can be called from process context

2023-03-11 16:31:59 +01:00

tcp_nv.c

…

tcp_offload.c

…

tcp_output.c

tcp: introduce tcp_skb_timestamp_us() helper

2024-11-08 16:19:08 +01:00

tcp_rate.c

tcp: introduce tcp_skb_timestamp_us() helper

2024-11-08 16:19:08 +01:00

tcp_recovery.c

tcp: introduce tcp_skb_timestamp_us() helper

2024-11-08 16:19:08 +01:00

tcp_scalable.c

…

tcp_timer.c

tcp: avoid too many retransmit packets

2024-07-18 11:39:38 +02:00

tcp_ulp.c

…

tcp_vegas.c

…

tcp_vegas.h

…

tcp_veno.c

…

tcp_westwood.c

…

tcp_yeah.c

…

tcp.c

tcp: Fix data races around icsk->icsk_af_ops.

2024-07-05 09:00:35 +02:00

tunnel4.c

…

udp_diag.c

…

udp_impl.h

…

udp_offload.c

net: Fix gro aggregation for udp encaps with zero csum

2021-03-17 16:43:42 +01:00

udp_tunnel.c

net/tunnel: wait until all sk_user_data reader finish before releasing the sock

2023-01-18 11:30:18 +01:00

udp.c

udp: preserve the connected status if only UDP cmsg

2024-05-02 16:17:14 +02:00

udplite.c

udplite: Fix NULL pointer dereference in __sk_mem_raise_allocated().

2023-05-30 12:42:14 +01:00

xfrm4_input.c

…

xfrm4_mode_beet.c

…

xfrm4_mode_transport.c

…

xfrm4_mode_tunnel.c

…

xfrm4_output.c

…

xfrm4_policy.c

xfrm: Don't accidentally set RTO_ONLINK in decode_session4()

2022-02-23 11:58:39 +01:00

xfrm4_protocol.c

net: xfrm: unexport __init-annotated xfrm4_protocol_init()

2022-06-14 16:59:35 +02:00

xfrm4_state.c

…

xfrm4_tunnel.c

…