Ignat Korchagin 157218c461 net: inet6: do not leave a dangling sk pointer in inet6_create() ...

[ Upstream commit 9df99c395d0f55fb444ef39f4d6f194ca437d884 ]

sock_init_data() attaches the allocated sk pointer to the provided sock
object. If inet6_create() fails later, the sk object is released, but the
sock object retains the dangling sk pointer, which may cause use-after-free
later.

Clear the sock sk pointer on error.

Signed-off-by: Ignat Korchagin <ignat@cloudflare.com>
Reviewed-by: Kuniyuki Iwashima <kuniyu@amazon.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Link: https://patch.msgid.link/20241014153808.51894-8-ignat@cloudflare.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Ulrich Hecht <uli@kernel.org>

2025-02-07 03:34:23 +01:00

..

ila

ila: call nf_unregister_net_hooks() sooner

2024-09-12 11:02:55 +02:00

netfilter

netfilter: nf_tables: prevent nf_skb_duplicated corruption

2024-11-08 16:19:10 +01:00

addrconf_core.c

ipv6: Ensure natural alignment of const ipv6 loopback and router addresses

2024-02-23 08:12:52 +01:00

addrconf.c

net: ipv6: ensure we call ipv6_mc_down() at most once

2024-11-08 16:19:18 +01:00

addrlabel.c

…

af_inet6.c

net: inet6: do not leave a dangling sk pointer in inet6_create()

2025-02-07 03:34:23 +01:00

ah6.c

…

anycast.c

…

calipso.c

…

datagram.c

ipv6: Fix datagram socket connection with DSCP.

2023-02-22 12:47:21 +01:00

esp6_offload.c

xfrm: Linearize the skb after offloading if needed.

2023-06-28 10:15:29 +02:00

esp6.c

net: ipv6: fix return value check in esp_remove_trailer

2023-10-25 11:16:45 +02:00

exthdrs_core.c

ipv6: Fix out-of-bounds access in ipv6_find_tlv()

2023-05-30 12:42:14 +01:00

exthdrs_offload.c

…

exthdrs.c

…

fib6_notifier.c

…

fib6_rules.c

ipv6: fib6_rules: avoid possible NULL dereference in fib6_rule_action()

2024-05-17 11:42:42 +02:00

fou6.c

…

icmp.c

icmp6: Fix null-ptr-deref of ip6_null_entry->rt6i_idev in icmp6_dev().

2023-08-11 11:45:18 +02:00

inet6_connection_sock.c

…

inet6_hashtables.c

…

ip6_checksum.c

…

ip6_fib.c

ipv6: fib: hide unused 'pn' variable

2024-05-02 16:17:08 +02:00

ip6_flowlabel.c

treewide: Remove uninitialized_var() usage

2023-08-11 11:45:01 +02:00

ip6_gre.c

erspan: make sure erspan_base_hdr is present in skb->head

2024-04-13 12:50:14 +02:00

ip6_icmp.c

…

ip6_input.c

…

ip6_offload.c

…

ip6_offload.h

…

ip6_output.c

ipv6: prevent UAF in ip6_send_skb()

2024-09-04 13:13:05 +02:00

ip6_tunnel.c

ip6_tunnel: fix NEXTHDR_FRAGMENT handling in ip6_tnl_parse_tlv_enc_lim()

2024-01-25 14:33:35 -08:00

ip6_udp_tunnel.c

…

ip6_vti.c

ip6_vti: fix slab-use-after-free in decode_session6

2023-08-30 16:31:48 +02:00

ip6mr.c

ipmr: convert /proc handlers to rcu_read_lock()

2025-02-07 03:34:20 +01:00

ipcomp6.c

…

ipv6_sockglue.c

tcp: Fix data races around icsk->icsk_af_ops.

2024-07-05 09:00:35 +02:00

Kconfig

…

Makefile

…

mcast_snoop.c

…

mcast.c

…

mip6.c

…

ndisc.c

ipv6: fix ndisc_is_useropt() handling for PIO

2024-08-19 05:32:09 +02:00

netfilter.c

…

output_core.c

…

ping.c

ping6: Fix send to link-local addresses with VRF.

2023-06-21 15:39:58 +02:00

proc.c

…

protocol.c

…

raw.c

ipv{4,6}/raw: fix output xfrm lookup wrt protocol

2023-06-09 10:23:54 +02:00

reassembly.c

vrf: Increment Icmp6InMsgs on the original netdev

2023-08-11 11:45:18 +02:00

route.c

net/ipv6: release expired exception dst cached in socket

2025-02-07 03:34:21 +01:00

seg6_hmac.c

ipv6: sr: fix memleak in seg6_hmac_init_algo

2024-06-16 13:23:35 +02:00

seg6_iptunnel.c

ipv6: sr: block BH in seg6_output_core() and seg6_input_core()

2024-07-05 09:00:20 +02:00

seg6_local.c

…

seg6.c

ipv6: sr: fix invalid unregister error path

2024-06-16 13:23:29 +02:00

sit.c

sit: update dev->needed_headroom in ipip6_tunnel_bind_dev()

2023-05-17 11:13:23 +02:00

syncookies.c

dccp/tcp: Call security_inet_conn_request() after setting IPv6 addresses.

2023-11-20 10:29:21 +01:00

sysctl_net_ipv6.c

…

tcp_ipv6.c

tcp: Fix data races around icsk->icsk_af_ops.

2024-07-05 09:00:35 +02:00

tcpv6_offload.c

…

tunnel6.c

…

udp_impl.h

tcp/udp: Call inet6_destroy_sock() in IPv6 sk->sk_destruct().

2023-04-26 11:21:52 +02:00

udp_offload.c

…

udp.c

udp: preserve the connected status if only UDP cmsg

2024-05-02 16:17:14 +02:00

udplite.c

udplite: Fix NULL pointer dereference in __sk_mem_raise_allocated().

2023-05-30 12:42:14 +01:00

xfrm6_input.c

…

xfrm6_mode_beet.c

…

xfrm6_mode_ro.c

…

xfrm6_mode_transport.c

…

xfrm6_mode_tunnel.c

…

xfrm6_output.c

…

xfrm6_policy.c

xfrm6: check ip6_dst_idev() return value in xfrm6_get_saddr()

2024-07-05 09:00:28 +02:00

xfrm6_protocol.c

…

xfrm6_state.c

…

xfrm6_tunnel.c

…