Eric Dumazet 330c8661c9 tcp: fix race in tcp_v6_syn_recv_sock() ...

[ Upstream commit d37fe4255abe8e7b419b90c5847e8ec2b8debb08 ]

tcp_v6_syn_recv_sock() calls ip6_dst_store() before
inet_sk(newsk)->pinet6 has been set up.

This means ip6_dst_store() writes over the parent (listener)
np->dst_cookie.

This is racy because multiple threads could share the same
parent and their final np->dst_cookie could be wrong.

Move ip6_dst_store() call after inet_sk(newsk)->pinet6
has been changed and after the copy of parent ipv6_pinfo.

Fixes: e994b2f0fb ("tcp: do not lock listener to process SYN packets")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>

2024-07-05 09:12:28 +02:00

..

ila

ila: do not generate empty messages in ila_xlat_nl_cmd_get_mapping()

2023-03-17 08:45:10 +01:00

netfilter

netfilter: complete validation of user input

2024-05-02 16:23:34 +02:00

addrconf_core.c

ipv6: Ensure natural alignment of const ipv6 loopback and router addresses

2024-02-23 08:42:17 +01:00

addrconf.c

ipv6: fix race condition between ipv6_get_ifaddr and ipv6_del_addr

2024-05-02 16:23:34 +02:00

addrlabel.c

ipv6: addrlabel: fix infoleak when sending struct ifaddrlblmsg to network

2022-11-16 09:57:11 +01:00

af_inet6.c

ipv6: init the accept_queue's spinlocks in inet6_create

2024-02-23 08:41:56 +01:00

ah6.c

xfrm: Use actual socket sk instead of skb socket for xfrm_output_resume

2021-04-14 08:42:05 +02:00

anycast.c

ipv6: fix memory leaks on IPV6_ADDRFORM path

2020-07-30 16:30:55 -07:00

calipso.c

cipso,calipso: resolve a number of problems with the DOI refcounts

2021-03-17 17:06:15 +01:00

datagram.c

ipv6: Fix datagram socket connection with DSCP.

2023-02-22 12:55:58 +01:00

esp6_offload.c

xfrm: Linearize the skb after offloading if needed.

2023-06-28 10:28:11 +02:00

esp6.c

net: ipv6: fix return value check in esp_remove_trailer

2023-10-25 11:54:19 +02:00

exthdrs_core.c

ipv6: Fix out-of-bounds access in ipv6_find_tlv()

2023-05-30 12:57:58 +01:00

exthdrs_offload.c

treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152

2019-05-30 11:26:32 -07:00

exthdrs.c

ipv6: rpl: Fix Route of Death.

2023-06-14 11:09:42 +02:00

fib6_notifier.c

net: fib_notifier: propagate extack down to the notifier block callback

2019-10-04 11:10:56 -07:00

fib6_rules.c

ipv6: fib6_rules: avoid possible NULL dereference in fib6_rule_action()

2024-05-17 11:48:07 +02:00

fou6.c

net: Add MODULE_DESCRIPTION entries to network modules

2020-06-20 21:33:57 -07:00

icmp.c

icmp6: Fix null-ptr-deref of ip6_null_entry->rt6i_idev in icmp6_dev().

2023-07-27 08:44:21 +02:00

inet6_connection_sock.c

lsm,selinux: pass flowi_common instead of flowi to the LSM hooks

2022-06-09 10:21:09 +02:00

inet6_hashtables.c

net: remove duplicate reuseport_lookup functions

2024-06-16 13:32:06 +02:00

ip6_checksum.c

net: udp: fix handling of CHECKSUM_COMPLETE packets

2018-10-24 14:18:16 -07:00

ip6_fib.c

ipv6: fix possible race in __fib6_drop_pcpu_from()

2024-07-05 09:12:23 +02:00

ip6_flowlabel.c

ipv6: per-netns exclusive flowlabel checks

2022-02-23 12:01:01 +01:00

ip6_gre.c

erspan: make sure erspan_base_hdr is present in skb->head

2024-04-13 12:59:27 +02:00

ip6_icmp.c

net: icmp: pass zeroed opts from icmp{,v6}_ndo_send before sending

2021-03-04 11:38:46 +01:00

ip6_input.c

tcp/udp: Make early_demux back namespacified.

2022-11-10 18:14:26 +01:00

ip6_offload.c

gso: do not skip outer ip header in case of ipip and net_failover

2022-03-02 11:42:49 +01:00

ip6_offload.h

treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152

2019-05-30 11:26:32 -07:00

ip6_output.c

ipv6: avoid atomic fragment on GSO packets

2023-11-20 11:06:46 +01:00

ip6_tunnel.c

ip6_tunnel: make sure to pull inner header in __ip6_tnl_rcv()

2024-02-23 08:42:16 +01:00

ip6_udp_tunnel.c

net: Make locking in sock_bindtoindex optional

2020-06-01 14:57:14 -07:00

ip6_vti.c

ip6_vti: fix slab-use-after-free in decode_session6

2023-08-26 15:26:52 +02:00

ip6mr.c

ip6mr: Fix skb_under_panic in ip6mr_cache_report()

2023-08-11 11:57:50 +02:00

ipcomp6.c

ipcomp: assign if_id to child tunnel from parent tunnel

2020-07-09 12:55:37 +02:00

ipv6_sockglue.c

net/ipv4/ipv6: Replace one-element arraya with flexible-array members

2024-03-26 18:21:53 -04:00

Kconfig

net: ipv6: fix kconfig dependency warning for IPV6_SEG6_HMAC

2020-09-18 17:45:04 -07:00

Makefile

net: ipv6: add rpl sr tunnel

2020-03-29 22:30:57 -07:00

mcast_snoop.c

net: bridge: mcast: fix broken length + header check for MRDv6 Adv.

2021-05-14 09:50:44 +02:00

mcast.c

mld: fix panic in mld_newpack()

2021-06-03 09:00:48 +02:00

mip6.c

xfrm: remove type and offload_type map from xfrm_state_afinfo

2019-06-06 08:34:50 +02:00

ndisc.c

net: change accept_ra_min_rtr_lft to affect all RA lifetimes

2023-10-25 11:54:14 +02:00

netfilter.c

netfilter: use actual socket sk rather than skb sk when routing harder

2020-10-30 12:57:39 +01:00

output_core.c

ipv6: use prandom_u32() for ID generation

2021-07-19 09:44:44 +02:00

ping.c

ping6: Fix send to link-local addresses with VRF.

2023-06-21 15:45:38 +02:00

proc.c

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

2019-06-07 11:00:14 -07:00

protocol.c

treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152

2019-05-30 11:26:32 -07:00

raw.c

ipv{4,6}/raw: fix output xfrm lookup wrt protocol

2023-06-05 09:07:04 +02:00

reassembly.c

net: ipv6: fix wrong start position when receive hop-by-hop fragment

2024-06-16 13:32:09 +02:00

route.c

ipv6: fix possible race in __fib6_drop_pcpu_from()

2024-07-05 09:12:23 +02:00

rpl_iptunnel.c

net: ipv6: Use struct_size() helper and kcalloc()

2020-06-23 20:27:09 -07:00

rpl.c

net: rpl: fix rpl header size calculation

2023-04-26 11:27:36 +02:00

seg6_hmac.c

ipv6: sr: fix memleak in seg6_hmac_init_algo

2024-06-16 13:32:26 +02:00

seg6_iptunnel.c

ipv6: sr: block BH in seg6_output_core() and seg6_input_core()

2024-07-05 09:12:22 +02:00

seg6_local.c

seg6: fix skb checksum in SRv6 End.B6 and End.B6.Encaps behaviors

2022-07-21 21:20:11 +02:00

seg6.c

ipv6: sr: fix invalid unregister error path

2024-06-16 13:32:10 +02:00

sit.c

sit: update dev->needed_headroom in ipip6_tunnel_bind_dev()

2023-05-17 11:48:10 +02:00

syncookies.c

dccp/tcp: Call security_inet_conn_request() after setting IPv6 addresses.

2023-11-20 11:06:55 +01:00

sysctl_net_ipv6.c

ipv6: Fix sysctl max for fib_multipath_hash_policy

2020-09-02 15:44:53 -07:00

tcp_ipv6.c

tcp: fix race in tcp_v6_syn_recv_sock()

2024-07-05 09:12:28 +02:00

tcpv6_offload.c

treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152

2019-05-30 11:26:32 -07:00

tunnel6.c

tunnel6: add tunnel6_input_afinfo for ipip and ipv6 tunnels

2020-07-09 12:52:37 +02:00

udp_impl.h

tcp/udp: Call inet6_destroy_sock() in IPv6 sk->sk_destruct().

2023-04-26 11:27:41 +02:00

udp_offload.c

udp: do not transition UDP GRO fraglist partial checksums to unnecessary

2024-04-13 12:59:28 +02:00

udp.c

udp: Avoid call to compute_score on multiple sites

2024-06-16 13:32:06 +02:00

udplite.c

udplite: Fix NULL pointer dereference in __sk_mem_raise_allocated().

2023-05-30 12:57:57 +01:00

xfrm6_input.c

xfrm: Preserve vlan tags for transport mode software GRO

2024-05-17 11:48:06 +02:00

xfrm6_output.c

xfrm: fix tunnel model fragmentation behavior

2022-04-08 14:39:47 +02:00

xfrm6_policy.c

xfrm6: fix inet6_dev refcount underflow problem

2023-10-25 11:54:26 +02:00

xfrm6_protocol.c

xfrm: add support for UDPv6 encapsulation of ESP

2020-04-28 11:28:36 +02:00

xfrm6_state.c

xfrm: remove output_finish indirection from xfrm_state_afinfo

2020-05-06 09:40:08 +02:00

xfrm6_tunnel.c

xfrm: interface: fix the priorities for ipip and ipv6 tunnels

2020-10-09 12:29:48 +02:00