Hyunwoo Kim eaa5e164a2 net: openvswitch: Fix Use-After-Free in ovs_ct_exit ... [ Upstream commit 5ea7b72d4fac2fdbc0425cd8f2ea33abe95235b2 ] Since kfree_rcu, which is called in the hlist_for_each_entry_rcu traversal of ovs_ct_limit_exit, is not part of the RCU read critical section, it is possible that the RCU grace period will pass during the traversal and the key will be free. To prevent this, it should be changed to hlist_for_each_entry_safe. Fixes: 11efd5cb04 ("openvswitch: Support conntrack zone limit") Signed-off-by: Hyunwoo Kim <v4bel@theori.io> Reviewed-by: Eric Dumazet <edumazet@google.com> Reviewed-by: Aaron Conole <aconole@redhat.com> Link: https://lore.kernel.org/r/ZiYvzQN/Ry5oeFQW@v4bel-B760M-AORUS-ELITE-AX Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>		2024-05-02 16:32:38 +02:00
..
6lowpan	6lowpan: Remove redundant initialisation.	2023-03-29 08:22:52 +01:00
9p	9p: Fix read/write debug statements to report server reply	2024-04-10 16:35:57 +02:00
802	…
8021q	vlan: skip nested type that is not IFLA_VLAN_QOS_MAPPING	2024-01-31 16:19:01 -08:00
appletalk	appletalk: Fix Use-After-Free in atalk_ioctl	2023-12-20 17:01:50 +01:00
atm	atm: Fix Use-After-Free in do_vcc_ioctl	2023-12-20 17:01:48 +01:00
ax25	ax25: Fix netdev refcount issue	2024-05-02 16:32:36 +02:00
batman-adv	batman-adv: Avoid infinite loop trying to resize local TT	2024-04-17 11:19:25 +02:00
bluetooth	Bluetooth: hci_sync: Using hci_cmd_sync_submit when removing Adv Monitor	2024-05-02 16:32:37 +02:00
bpf	bpf: Fix a few selftest failures due to llvm18 change	2024-02-05 20:14:20 +00:00
bpfilter	net: Use umd_cleanup_helper()	2023-05-31 13:06:57 +02:00
bridge	bridge/br_netlink.c: no need to return void function	2024-05-02 16:32:35 +02:00
caif	sock: Remove ->sendpage*() in favour of sendmsg(MSG_SPLICE_PAGES)	2023-06-24 15:50:13 -07:00
can	can: j1939: Fix UAF in j1939_sk_match_filter during setsockopt(SO_J1939_FILTER)	2024-02-23 09:25:17 +01:00
ceph	libceph: fail sparse-read if the data length doesn't match	2024-03-01 13:34:56 +01:00
core	net: make SK_MEMORY_PCPU_RESERV tunable	2024-05-02 16:32:36 +02:00
dcb	net: dcb: choose correct policy to parse DCB_ATTR_BCN	2023-08-01 21:07:46 -07:00
dccp	dccp/tcp: Call security_inet_conn_request() after setting IPv6 addresses.	2023-11-20 11:59:35 +01:00
devlink	devlink: fix port new reply cmd type	2024-03-26 18:20:11 -04:00
dns_resolver	keys, dns: Fix size check of V1 server-list header	2024-01-25 15:35:41 -08:00
dsa	net: dsa: mark parsed interface mode for legacy switch drivers	2023-08-09 13:08:09 -07:00
ethernet	…
ethtool	ethtool: netlink: Add missing ethnl_ops_begin/complete	2024-01-25 15:36:00 -08:00
handshake	net/handshake: Fix handshake_req_destroy_test1	2024-02-23 09:24:50 +01:00
hsr	net: hsr: hsr_slave: Fix the promiscuous mode in offload mode	2024-04-10 16:35:42 +02:00
ieee802154	sysctl-6.6-rc1	2023-08-29 17:39:15 -07:00
ife	net: sched: ife: fix potential use-after-free	2024-01-01 12:42:30 +00:00
ipv4	ipv4: check for NULL idev in ip_route_use_hint()	2024-05-02 16:32:36 +02:00
ipv6	netfilter: complete validation of user input	2024-04-17 11:19:30 +02:00
iucv	net/iucv: fix the allocation size of iucv_path_table array	2024-03-26 18:19:12 -04:00
kcm	net: kcm: fix incorrect parameter validation in the kcm_getsockopt) function	2024-03-26 18:19:40 -04:00
key	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2023-08-18 12:44:56 -07:00
l2tp	l2tp: fix incorrect parameter validation in the pppol2tp_getsockopt() function	2024-03-26 18:19:40 -04:00
l3mdev	…
lapb	…
llc	llc: call sock_orphan() at release time	2024-02-05 20:14:36 +00:00
mac80211	wifi: mac80211: fix unaligned le16 access	2024-05-02 16:32:34 +02:00
mac802154	mac802154: fix llsec key resources release in mac802154_llsec_key_del	2024-04-03 15:28:27 +02:00
mctp	net: mctp: copy skb ext data when fragmenting	2024-03-26 18:19:34 -04:00
mpls	net: mpls: error out if inner headers are not set	2024-04-13 13:07:41 +02:00
mptcp	mptcp: don't account accept() of non-MPC client as fallback to TCP	2024-04-10 16:36:06 +02:00
ncsi	net/ncsi: Fix netlink major/minor version numbers	2024-01-25 15:35:20 -08:00
netfilter	ipvs: Fix checksumming on GSO of SCTP packets	2024-05-02 16:32:37 +02:00
netlabel	calipso: fix memory leak in netlbl_calipso_add_pass()	2024-01-25 15:35:14 -08:00
netlink	netlink: Fix kernel-infoleak-after-free in __skb_datagram_iter	2024-03-06 14:48:34 +00:00
netrom	netrom: Fix data-races around sysctl_net_busy_read	2024-03-15 10:48:21 -04:00
nfc	nfc: nci: Fix uninit-value in nci_dev_up and nci_ntf_packet	2024-04-10 16:35:41 +02:00
nsh	net: move gso declarations and functions to their own files	2023-06-10 00:11:41 -07:00
openvswitch	net: openvswitch: Fix Use-After-Free in ovs_ct_exit	2024-05-02 16:32:38 +02:00
packet	packet: annotate data-races around ignore_outgoing	2024-03-26 18:20:10 -04:00
phonet	phonet/pep: fix racy skb_queue_empty() use	2024-03-01 13:35:10 +01:00
psample	psample: Require 'CAP_NET_ADMIN' when joining "packets" group	2023-12-13 18:45:10 +01:00
qrtr	net: qrtr: ns: Return 0 if server port is not present	2024-01-20 11:51:47 +01:00
rds	net/rds: fix possible cp null dereference	2024-04-10 16:35:49 +02:00
rfkill	net: rfkill: gpio: set GPIO direction	2024-01-01 12:42:41 +00:00
rose	net/rose: fix races in rose_kill_by_device()	2024-01-01 12:42:31 +00:00
rxrpc	rxrpc: Fix counting of new acks and nacks	2024-02-16 19:10:50 +01:00
sched	net/sched: fix lockdep splat in qdisc_tree_reduce_backlog()	2024-04-10 16:35:51 +02:00
sctp	sctp: fix busy polling	2024-01-25 15:35:30 -08:00
smc	net/smc: reduce rtnl pressure in smc_pnet_create_pnetids_list()	2024-04-13 13:07:33 +02:00
strparser	…
sunrpc	SUNRPC: Fix a slow server-side memory leak with RPC-over-TCP	2024-04-10 16:36:01 +02:00
switchdev	net: bridge: switchdev: Skip MDB replays of deferred events on offload	2024-03-01 13:35:06 +01:00
tipc	tipc: Check the bearer type before calling tipc_udp_nl_bearer_add()	2024-02-16 19:10:50 +01:00
tls	tls: get psock ref after taking rxlock to avoid leak	2024-04-10 16:35:43 +02:00
unix	af_unix: Don't peek OOB data without MSG_OOB.	2024-04-27 17:11:32 +02:00
vmw_vsock	vsock/virtio: fix packet delivery to tap device	2024-04-10 16:35:50 +02:00
wireless	wifi: cfg80211: check A-MSDU format more carefully	2024-04-13 13:07:32 +02:00
x25	net/x25: fix incorrect parameter validation in the x25_getsockopt() function	2024-03-26 18:19:41 -04:00
xdp	xsk: validate user input for XDP_{UMEM|COMPLETION}_FILL_RING	2024-04-17 11:19:28 +02:00
xfrm	xfrm: Avoid clang fortify warning in copy_to_user_tmpl()	2024-04-03 15:28:40 +02:00
Kconfig	bpf: Add fd-based tcx multi-prog infra with link support	2023-07-19 10:07:27 -07:00
Kconfig.debug	…
Makefile	net/handshake: Create a NETLINK service for handling handshake requests	2023-04-19 18:48:48 -07:00
compat.c	net/compat: Update msg_control_is_user when setting a kernel pointer	2023-04-14 11:09:27 +01:00
devres.c	…
socket.c	net: Save and restore msg_namelen in sock_sendmsg	2024-01-10 17:16:51 +01:00
sysctl_net.c	sysctl: Add size to register_net_sysctl function	2023-08-15 15:26:17 -07:00