Ubuntu-focal-kernel/include/net
Eric Dumazet 64f96d646e net: fix __dst_negative_advice() race
BugLink: https://bugs.launchpad.net/bugs/2071668

commit 92f1655aa2b2294d0b49925f3b875a634bd3b59e upstream.

__dst_negative_advice() does not enforce proper RCU rules when
sk->dst_cache must be cleared, leading to possible UAF.

RCU rules are that we must first clear sk->sk_dst_cache,
then call dst_release(old_dst).

Note that sk_dst_reset(sk) is implementing this protocol correctly,
while __dst_negative_advice() uses the wrong order.

Given that ip6_negative_advice() has special logic
against RTF_CACHE, this means each of the three ->negative_advice()
existing methods must perform the sk_dst_reset() themselves.

Note the check against NULL dst is centralized in
__dst_negative_advice(), there is no need to duplicate
it in various callbacks.

Many thanks to Clement Lecigne for tracking this issue.

This old bug became visible after the blamed commit, using UDP sockets.

Fixes: a87cb3e48e ("net: Facility to report route quality of connected sockets")
Reported-by: Clement Lecigne <clecigne@google.com>
Diagnosed-by: Clement Lecigne <clecigne@google.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Tom Herbert <tom@herbertland.com>
Reviewed-by: David Ahern <dsahern@kernel.org>
Link: https://lore.kernel.org/r/20240528114353.1794151-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
[Lee: Stable backport]
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Portia Stephens <portia.stephens@canonical.com>
Signed-off-by: Stefan Bader <stefan.bader@canonical.com>
2024-07-05 10:52:03 +02:00
..
9p
bluetooth Bluetooth: Fix bogus check for re-auth no supported with non-ssp 2024-02-29 15:23:37 +01:00
caif net: caif: add proper error handling 2021-07-15 19:27:06 +02:00
iucv
netfilter netfilter: nf_tables: restrict tunnel object to NFPROTO_NETDEV 2024-07-05 10:51:55 +02:00
netns ipv6: make ip6_rt_gc_expire an atomic_t 2024-02-23 13:48:05 +01:00
nfc nfc: constify several pointers to u8, char and sk_buff 2023-10-02 12:12:01 +02:00
phonet
sctp sctp: add a refcnt in sctp_stream_priorities to avoid a nested loop 2023-05-12 17:15:13 +02:00
tc_act net/sched: act_pedit: really ensure the skb is writable 2022-07-11 16:40:04 +02:00
6lowpan.h
Space.h
act_api.h net: sched: extract qstats update code into functions 2023-07-10 17:21:44 +02:00
addrconf.h ipv6: fix race condition between ipv6_get_ifaddr and ipv6_del_addr 2024-06-07 15:01:43 +02:00
af_ieee802154.h
af_rxrpc.h rxrpc: Make rxrpc_kernel_get_srtt() indicate validity 2020-09-17 00:47:03 -06:00
af_unix.h af_unix: Suppress false-positive lockdep splat for spin_lock() in __unix_gc(). 2024-06-07 15:01:46 +02:00
af_vsock.h
ah.h
arp.h ipv4: Invalidate neighbour for broadcast address upon address addition 2022-05-20 15:19:46 +02:00
atmclip.h
ax25.h ax25: fix reference count leaks of ax25_dev 2022-06-22 14:50:41 +02:00
ax88796.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
bond_3ad.h bonding: fix data-races around agg_select_timer 2022-04-14 11:32:21 +02:00
bond_alb.h bonding (gcc13): synchronize bond_{a,t}lb_xmit() types 2023-09-01 14:48:42 +02:00
bond_options.h bonding: add an option to specify a delay between peer notifications 2019-07-04 12:30:48 -07:00
bonding.h bonding: fix macvlan over alb bond support 2023-10-30 11:42:02 +01:00
bpf_sk_storage.h bpf: support cloning sk storage on accept() 2019-08-17 23:18:54 +02:00
busy_poll.h net: Fix a data-race around sysctl_net_busy_poll. 2022-10-17 15:02:14 +02:00
calipso.h
cfg80211-wext.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
cfg80211.h wifi: cfg80211: fix sband iftype data lookup for AP_VLAN 2023-10-30 11:41:53 +01:00
cfg802154.h
checksum.h net: Force inlining of checksum functions in net/checksum.h 2022-05-20 15:17:13 +02:00
cipso_ipv4.h
cls_cgroup.h
codel.h
codel_impl.h
codel_qdisc.h
compat.h
datalink.h
dcbevent.h
dcbnl.h
devlink.h devlink: Add new "enable_roce" generic device param 2020-08-08 01:53:12 -04:00
drop_monitor.h net: drop_monitor: use IS_REACHABLE() to guard net_dm_hw_report() 2020-06-22 17:22:25 -03:00
dsa.h net: dsa: Pass ndo_setup_tc slave callback to drivers 2019-09-16 21:32:57 +02:00
dsfield.h
dst.h net: Remove unused inline function dst_hold_and_use() 2023-09-01 14:48:46 +02:00
dst_cache.h
dst_metadata.h net: fix a memleak when uncloning an skb dst and its metadata 2022-04-14 11:32:05 +02:00
dst_ops.h net: fix __dst_negative_advice() race 2024-07-05 10:52:03 +02:00
erspan.h erspan: Add type I version 0 support. 2024-06-07 15:01:40 +02:00
esp.h esp: limit skb_page_frag_refill use to a single page 2022-09-16 10:58:54 +02:00
ethoc.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
failover.h
fib_notifier.h
fib_rules.h ipv6: fix memory leak in fib6_rule_suppress 2022-02-03 18:57:31 +01:00
firewire.h
flow.h inet: shrink struct flowi_common 2024-02-02 14:13:06 +01:00
flow_dissector.h net/sched: flower: fix parsing of ethertype following VLAN header 2022-06-22 14:50:29 +02:00
flow_offload.h net: core: rename indirect block ingress cb function 2020-01-06 07:42:36 -06:00
fou.h
fq.h net/flow_dissector: switch to siphash 2019-10-23 20:13:22 -07:00
fq_impl.h net/fq_impl: Switch to kvmalloc() for memory allocation 2019-11-08 09:11:49 +01:00
garp.h
gen_stats.h
genetlink.h drop_monitor: Require 'CAP_SYS_ADMIN' when joining "events" group 2024-02-02 14:13:20 +01:00
geneve.h
gre.h
gro_cells.h
gtp.h
gue.h net:gue.h:Fix shifting signed 32-bit value by 31 bits problem 2019-07-01 10:58:23 -07:00
hwbm.h net: hwbm: if CONFIG_NET_HWBM unset, make stub functions static 2019-10-25 16:24:32 -07:00
icmp.h net: icmp: pass zeroed opts from icmp{,v6}_ndo_send before sending 2021-04-14 18:31:42 +02:00
ieee80211_radiotap.h
ieee802154_netdev.h net: ieee802154: return -EINVAL for unknown addr type 2023-01-06 08:44:06 -08:00
if_inet6.h net: ipv6: support reporting otherwise unknown prefix flags in RTM_NEWPREFIX 2024-02-02 14:13:20 +01:00
ife.h
ila.h
inet6_connection_sock.h
inet6_hashtables.h
inet_common.h inet: factor out inet_send_prepare() 2019-07-03 13:51:54 -07:00
inet_connection_sock.h tcp: properly terminate timers for kernel sockets 2024-06-07 15:01:38 +02:00
inet_ecn.h inet_ecn: Fix endianness of checksum update when setting ECT(1) 2021-01-20 14:24:53 +01:00
inet_frag.h inet: frags: annotate races around fqdir->dead and fqdir->high_thresh 2022-03-07 16:36:56 +01:00
inet_hashtables.h secure_seq: use the 64 bits of the siphash for port offset calculation 2022-08-26 11:06:57 +02:00
inet_sock.h tcp/dccp: Fix a data-race around sysctl_tcp_fwmark_accept. 2022-09-16 10:59:42 +02:00
inet_timewait_sock.h tcp: honor SO_PRIORITY in TIME_WAIT state 2019-09-27 12:05:02 +02:00
inetpeer.h
ip.h ipv{4,6}/raw: fix output xfrm lookup wrt protocol 2023-08-09 12:25:36 +02:00
ip6_checksum.h
ip6_fib.h ipv6: annotate accesses to fn->fn_sernum 2022-03-29 09:13:47 +02:00
ip6_route.h net: ipv6: fix returned variable type in ip6_skb_dst_mtu 2021-09-20 18:50:02 +02:00
ip6_tunnel.h ip_gre, ip6_gre: Fix race condition on o_seqno in collect_md mode 2023-08-09 12:25:30 +02:00
ip_fib.h ipv4: convert fib_num_tclassid_users to atomic_t 2022-02-03 18:57:30 +01:00
ip_tunnels.h geneve: fix header validation in geneve[6]_xmit_skb 2024-06-07 15:01:43 +02:00
ip_vs.h ipvs: allow connection reuse for unconfirmed conntrack 2020-09-04 16:29:07 -03:00
ipcomp.h
ipconfig.h
ipv6.h tcp: Reduce chance of collisions in inet6_hashfn(). 2023-09-01 14:48:46 +02:00
ipv6_frag.h inet: frags: annotate races around fqdir->dead and fqdir->high_thresh 2022-03-07 16:36:56 +01:00
ipv6_stubs.h net: ipv6: add fib6_nh_release_dsts stub 2022-02-03 18:57:00 +01:00
ipx.h bonding/alb: properly access headers in bond_alb_xmit() 2020-02-17 12:07:04 +01:00
iw_handler.h
kcm.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
l3mdev.h
lag.h
lapb.h
lib80211.h
llc.h llc: fix out-of-bound array index in llc_sk_dev_hash() 2022-01-13 18:42:41 +01:00
llc_c_ac.h
llc_c_ev.h
llc_c_st.h
llc_conn.h llc: fix sk_buff leak in llc_conn_service() 2019-10-08 13:23:05 -07:00
llc_if.h
llc_pdu.h llc: Drop support for ETH_P_TR_802_2. 2024-03-28 15:18:31 +01:00
llc_s_ac.h
llc_s_ev.h
llc_s_st.h
llc_sap.h
lwtunnel.h lwt: Check LWTUNNEL_XMIT_CONTINUE strictly 2023-10-30 11:42:08 +01:00
mac80211.h mac80211: populate debugfs only after cfg80211 init 2020-05-25 10:41:52 +02:00
mac802154.h
mip6.h
mld.h
mpls.h
mpls_iptunnel.h
mrp.h mrp: introduce active flags to prevent UAF when applicant uninit 2023-02-01 15:23:13 +01:00
ncsi.h
ndisc.h net: avoid potential false sharing in neighbor related code 2020-01-06 08:16:15 -06:00
neighbour.h neighbour: delete neigh_lookup_nodev as not used 2023-09-01 14:48:46 +02:00
net_failover.h
net_namespace.h net: make get_net_ns return error if NET_NS is disabled 2021-07-15 19:27:37 +02:00
net_ratelimit.h
netevent.h
netlabel.h
netlink.h netlink: Fix nlmsg_parse as a wrapper for strict message parsing 2019-08-13 20:37:16 -07:00
netprio_cgroup.h
netrom.h
nexthop.h net: ipv4: Fix rtnexthop len when RTA_FLOW is present 2021-11-05 09:12:49 +01:00
nl802154.h net: ieee802154: handle iftypes as u32 2022-02-03 18:56:57 +01:00
nsh.h
p8022.h
page_pool.h mm: fix struct page layout on 32-bit systems 2021-06-18 15:02:19 +02:00
ping.h
pkt_cls.h net_sched: fix ops->bind_class() implementations 2020-02-04 09:18:19 +00:00
pkt_sched.h net/sched: make psched_mtu() RTNL-less safe 2023-10-02 12:12:11 +02:00
pptp.h
protocol.h tcp/udp: Make early_demux back namespacified. 2023-01-06 08:44:44 -08:00
psample.h psample: Add a fwd declaration for skbuff 2021-09-24 12:27:30 +02:00
psnap.h
raw.h raw: Fix a data-race around sysctl_raw_l3mdev_accept. 2022-09-16 10:59:20 +02:00
rawv6.h
red.h sch_red: fix off-by-one checks in red_check_params() 2021-05-04 16:08:50 +02:00
regulatory.h
request_sock.h net: add {READ|WRITE}_ONCE() annotations on ->rskq_accept_head 2019-10-09 21:34:31 -07:00
rose.h
route.h ipv4: remove sparse error in ip_neigh_gw4() 2022-03-29 09:13:51 +02:00
rsi_91x.h
rtnetlink.h net: validate veth and vxcan peer ifindexes 2023-10-30 11:42:01 +01:00
rtnh.h
sch_generic.h net: sched: remove unused tcf_result extension 2023-07-10 17:21:44 +02:00
scm.h scm: fix MSG_CTRUNC setting condition for SO_PASSSEC 2023-08-09 12:25:17 +02:00
secure_seq.h secure_seq: use the 64 bits of the siphash for port offset calculation 2022-08-26 11:06:57 +02:00
seg6.h
seg6_hmac.h
seg6_local.h
slhc_vj.h
smc.h
snmp.h
sock.h net: fix __dst_negative_advice() race 2024-07-05 10:52:03 +02:00
sock_reuseport.h udp: correct reuseport selection with connected sockets 2019-09-16 09:02:18 +02:00
stp.h
strparser.h tls: rx: don't store the decryption status in socket context 2024-07-05 10:51:49 +02:00
switchdev.h
tcp.h tcp: factor out __tcp_close() helper 2024-04-26 10:54:06 +02:00
tcp_states.h
timewait_sock.h
tipc.h
tls.h tls: fix race between async notify and socket close 2024-07-05 10:51:50 +02:00
transp_v6.h
tso.h
tun_proto.h
udp.h tcp/udp: Call inet6_destroy_sock() in IPv6 sk->sk_destruct(). 2023-08-09 12:25:12 +02:00
udp_tunnel.h udp: call udp_encap_enable for v6 sockets when enabling encap 2022-05-20 15:18:25 +02:00
udplite.h tcp/udp: Call inet6_destroy_sock() in IPv6 sk->sk_destruct(). 2023-08-09 12:25:12 +02:00
vsock_addr.h
vxlan.h vxlan: calculate correct header length for GPE 2023-10-30 11:41:45 +01:00
wext.h
wimax.h
x25.h
x25device.h
xdp.h xdp: page_pool related fix to cpumap 2019-06-19 11:23:13 -04:00
xdp_priv.h page_pool: do not release pool until inflight == 0. 2020-01-06 07:42:38 -06:00
xdp_sock.h xsk: add support to allow unaligned chunk placement 2019-08-31 01:08:26 +02:00
xfrm.h xfrm: Preserve vlan tags for transport mode software GRO 2024-07-05 10:51:53 +02:00