Zhang Changzhong c21bff1c99 xfrm6: fix inet6_dev refcount underflow problem ... [ Upstream commit cc9b364bb1d58d3dae270c7a931a8cc717dc2b3b ] There are race conditions that may lead to inet6_dev refcount underflow in xfrm6_dst_destroy() and rt6_uncached_list_flush_dev(). One of the refcount underflow bugs is shown below: (cpu 1) | (cpu 2) xfrm6_dst_destroy() | ... | in6_dev_put() | | rt6_uncached_list_flush_dev() ... | ... | in6_dev_put() rt6_uncached_list_del() | ... ... | xfrm6_dst_destroy() calls rt6_uncached_list_del() after in6_dev_put(), so rt6_uncached_list_flush_dev() has a chance to call in6_dev_put() again for the same inet6_dev. Fix it by moving in6_dev_put() after rt6_uncached_list_del() in xfrm6_dst_destroy(). Fixes: 510c321b55 ("xfrm: reuse uncached_list to track xdsts") Signed-off-by: Zhang Changzhong <zhangchangzhong@huawei.com> Reviewed-by: Xin Long <lucien.xin@gmail.com> Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com> Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2023-10-25 12:03:12 +02:00
..
6lowpan
9p	9p: virtio: make sure 'offs' is initialized in zc_request	2023-09-13 09:42:21 +02:00
802
8021q	vlan: fix a potential uninit-value in vlan_dev_hard_start_xmit()	2023-05-24 17:32:47 +01:00
appletalk
atm	atm: hide unused procfs functions	2023-06-09 10:34:16 +02:00
ax25
batman-adv	batman-adv: Hold rtnl lock during MTU update via netlink	2023-08-30 16:11:08 +02:00
bluetooth	Bluetooth: hci_core: Fix build warnings	2023-10-25 12:03:10 +02:00
bpf	Revert "bpf, test_run: fix &xdp_frame misplacement for LIVE_FRAMES"	2023-03-17 08:50:32 +01:00
bpfilter
bridge	neighbour: fix data-races around n->output	2023-10-10 22:00:42 +02:00
caif	net: caif: Fix use-after-free in cfusbl_device_notify()	2023-03-17 08:50:24 +01:00
can	can: isotp: isotp_sendmsg(): fix TX state detection and wait behavior	2023-10-19 23:08:52 +02:00
ceph	libceph: use kernel_connect()	2023-10-19 23:08:56 +02:00
core	net: check for altname conflicts when changing netdev's netns	2023-10-25 12:03:08 +02:00
dcb	net: dcb: choose correct policy to parse DCB_ATTR_BCN	2023-08-11 12:08:17 +02:00
dccp	dccp: fix dccp_v4_err()/dccp_v6_err() again	2023-10-06 14:56:39 +02:00
devlink	devlink: remove reload failed checks in params get/set callbacks	2023-09-23 11:11:01 +02:00
dns_resolver
dsa	net: dsa: sja1105: always enable the send_meta options	2023-07-19 16:22:06 +02:00
ethernet
ethtool	ipv6: Remove in6addr_any alternatives.	2023-09-19 12:28:10 +02:00
hsr	net: hsr: Add __packed to struct hsr_sup_tlv.	2023-10-06 14:56:57 +02:00
ieee802154
ife
ipv4	ipv4/fib: send notify when delete source address routes	2023-10-25 12:03:11 +02:00
ipv6	xfrm6: fix inet6_dev refcount underflow problem	2023-10-25 12:03:12 +02:00
iucv	net/iucv: Fix size of interrupt data	2023-03-22 13:33:50 +01:00
kcm	kcm: Fix error handling for SOCK_DGRAM in kcm_sendmsg().	2023-09-19 12:28:10 +02:00
key	net: af_key: fix sadb_x_filter validation	2023-08-23 17:52:32 +02:00
l2tp	ipv4, ipv6: Fix handling of transhdrlen in __ip{,6}_append_data()	2023-10-10 22:00:42 +02:00
l3mdev
lapb
llc	llc: Don't drop packet from non-root netns.	2023-07-27 08:50:45 +02:00
mac80211	wifi: mac80211: allow transmitting EAPOL frames with tainted key	2023-10-25 12:03:10 +02:00
mac802154
mctp	mctp: perform route lookups under a RCU read-side lock	2023-10-19 23:08:57 +02:00
mpls
mptcp	mptcp: more conservative check for zero probes	2023-10-25 12:03:04 +02:00
ncsi	ncsi: Propagate carrier gain/loss events to the NCSI controller	2023-10-06 14:56:57 +02:00
netfilter	netfilter: nf_tables: revert do not remove elements if set backend implements .abort	2023-10-25 12:03:07 +02:00
netlabel	netlabel: fix shift wrapping bug in netlbl_catmap_setlong()	2023-09-13 09:42:24 +02:00
netlink	netlink: remove the flex array from struct nlmsghdr	2023-10-10 22:00:46 +02:00
netrom	netrom: Deny concurrent connect().	2023-09-13 09:42:35 +02:00
nfc	nfc: nci: fix possible NULL pointer dereference in send_acknowledge()	2023-10-25 12:03:04 +02:00
nsh	net: nsh: Use correct mac_offset to unwind gso skb in nsh_gso_segment()	2023-05-24 17:32:45 +01:00
openvswitch	net: openvswitch: reject negative ifindex	2023-08-23 17:52:35 +02:00
packet	net/packet: annotate data-races around tp->status	2023-08-16 18:27:26 +02:00
phonet
psample
qrtr	net: qrtr: Fix an uninit variable access bug in qrtr_tx_resume()	2023-04-20 12:35:09 +02:00
rds	net: prevent address rewrite in kernel_bind()	2023-10-19 23:08:50 +02:00
rfkill	net: rfkill: gpio: prevent value glitch during probe	2023-10-25 12:03:06 +02:00
rose
rxrpc	rxrpc: Fix hard call timeout units	2023-05-17 11:53:35 +02:00
sched	net/sched: sch_hfsc: upgrade 'rt' to 'sc' when it becomes a inner curve	2023-10-25 12:03:07 +02:00
sctp	sctp: update hb timer immediately after users change hb_interval	2023-10-10 22:00:44 +02:00
smc	net/smc: return the right falback reason when prefix checks fail	2023-10-25 12:03:03 +02:00
strparser
sunrpc	Revert "SUNRPC dont update timeout value on connection reset"	2023-10-06 14:57:03 +02:00
switchdev
tipc	tipc: fix a potential deadlock on &tx->lock	2023-10-10 22:00:43 +02:00
tls	net/tls: do not free tls_rec on async operation in bpf_exec_tx_verdict()	2023-09-19 12:28:09 +02:00
unix	af_unix: Fix data-race around unix_tot_inflight.	2023-09-19 12:28:02 +02:00
vmw_vsock	vsock: avoid to close connected socket after the timeout	2023-05-24 17:32:44 +01:00
wireless	wifi: cfg80211: avoid leaking stack data into trace	2023-10-25 12:03:11 +02:00
x25
xdp	xsk: Fix xsk_diag use-after-free error during socket cleanup	2023-09-19 12:28:01 +02:00
xfrm	net: xfrm: skip policies marked as dead while reinserting policies	2023-10-25 12:03:12 +02:00
compat.c
devres.c
Kconfig
Kconfig.debug
Makefile	devlink: move code to a dedicated directory	2023-08-30 16:11:00 +02:00
socket.c	net: prevent address rewrite in kernel_bind()	2023-10-19 23:08:50 +02:00
sysctl_net.c