Thadeu Lima de Souza Cascardo b6dbfd5bcc net: fix out-of-bounds access in ops_init ... commit a26ff37e624d12e28077e5b24d2b264f62764ad6 upstream. net_alloc_generic is called by net_alloc, which is called without any locking. It reads max_gen_ptrs, which is changed under pernet_ops_rwsem. It is read twice, first to allocate an array, then to set s.len, which is later used to limit the bounds of the array access. It is possible that the array is allocated and another thread is registering a new pernet ops, increments max_gen_ptrs, which is then used to set s.len with a larger than allocated length for the variable array. Fix it by reading max_gen_ptrs only once in net_alloc_generic. If max_gen_ptrs is later incremented, it will be caught in net_assign_generic. Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@igalia.com> Fixes: 073862ba5d ("netns: fix net_alloc_generic()") Reviewed-by: Eric Dumazet <edumazet@google.com> Reviewed-by: Kuniyuki Iwashima <kuniyu@amazon.com> Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20240502132006.3430840-1-cascardo@igalia.com Signed-off-by: Paolo Abeni <pabeni@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2024-05-17 12:02:35 +02:00
..
bpf_sk_storage.c	bpf: Add length check for SK_DIAG_BPF_STORAGE_REQ_MAP_FD parsing	2023-07-27 10:07:56 -07:00
datagram.c	net: datagram: fix data-races in datagram_poll()	2023-05-10 19:06:49 -07:00
dev.c	net: report RCU QS on threaded NAPI repolling	2024-03-26 18:20:12 -04:00
dev.h	net: fix removing a namespace with conflicting altnames	2024-01-31 16:19:01 -08:00
dev_addr_lists.c	net: extract a few internals from netdevice.h	2022-04-07 20:32:09 -07:00
dev_addr_lists_test.c	kunit: Use KUNIT_EXPECT_MEMEQ macro	2022-10-27 02:40:14 -06:00
dev_ioctl.c	net: omit ndo_hwtstamp_get() call when possible in dev_set_hwtstamp_phylib()	2023-08-06 13:25:10 +01:00
drop_monitor.c	drop_monitor: Require 'CAP_SYS_ADMIN' when joining "events" group	2023-12-13 18:45:10 +01:00
dst.c	net: remove unnecessary input parameter 'how' in ifdown function	2023-08-22 13:19:02 +02:00
dst_cache.c	wireguard: device: reset peer src endpoint when netns exits	2021-11-29 19:50:45 -08:00
failover.c	net: failover: use IFF_NO_ADDRCONF flag to prevent ipv6 addrconf	2022-12-12 15:18:25 -08:00
fib_notifier.c
fib_rules.c	fib: expand fib_rule_policy	2021-12-16 07:18:35 -08:00
filter.c	xdp: use flags field to disambiguate broadcast redirect	2024-05-17 12:02:02 +02:00
flow_dissector.c	net/core: Fix ETH_P_1588 flow dissector	2023-09-15 10:40:04 +01:00
flow_offload.c	tc: flower: Enable offload support IPSEC SPI field.	2023-08-02 10:09:32 +01:00
gen_estimator.c	treewide: Convert del_timer*() to timer_shutdown*()	2022-12-25 13:38:09 -08:00
gen_stats.c	net: Remove the obsolte u64_stats_fetch_*_irq() users (net).	2022-10-28 20:13:54 -07:00
gro.c	net: gro: fix udp bad offset in socket lookup by adding {inner_}network_offset to napi_gro_cb	2024-05-17 12:02:07 +02:00
gro_cells.c	net: drop the weight argument from netif_napi_add	2022-09-28 18:57:14 -07:00
gso.c	net: move gso declarations and functions to their own files	2023-06-10 00:11:41 -07:00
hwbm.c
link_watch.c	net-sysfs: convert dev->operstate reads to lockless ones	2024-05-17 12:02:23 +02:00
lwt_bpf.c	lwt: Fix return values of BPF xmit ops	2023-08-18 16:05:26 +02:00
lwtunnel.c	xfrm: lwtunnel: squelch kernel warning in case XFRM encap type is not available	2022-10-12 10:45:51 +02:00
Makefile	net: move gso declarations and functions to their own files	2023-06-10 00:11:41 -07:00
neighbour.c	neighbour: Don't let neigh_forced_gc() disable preemption for long	2024-01-20 11:51:43 +01:00
net-procfs.c	net-sysfs: display two backlog queue len separately	2023-03-22 12:03:52 +01:00
net-sysfs.c	net-sysfs: convert dev->operstate reads to lockless ones	2024-05-17 12:02:23 +02:00
net-sysfs.h	net-sysfs: add netdev_change_owner()	2020-02-26 20:07:25 -08:00
net-traces.c	udp6: add a missing call into udp_fail_queue_rcv_skb tracepoint	2023-07-07 09:16:52 +01:00
net_namespace.c	net: fix out-of-bounds access in ops_init	2024-05-17 12:02:35 +02:00
netclassid_cgroup.c	core: Variable type completion	2022-08-31 09:40:34 +01:00
netdev-genl-gen.c	net: ynl: prefix uAPI header include with uapi/	2023-05-26 10:30:14 +01:00
netdev-genl-gen.h	net: ynl: prefix uAPI header include with uapi/	2023-05-26 10:30:14 +01:00
netdev-genl.c	netdev-genl: use struct genl_info for reply construction	2023-08-15 15:01:03 -07:00
netevent.c	net: core: Correct function name netevent_unregister_notifier() in the kerneldoc	2021-03-28 17:56:56 -07:00
netpoll.c	netpoll: allocate netdev tracker right away	2023-06-15 08:21:11 +01:00
netprio_cgroup.c	bpf, cgroups: Fix cgroup v2 fallback on v1/v2 mixed mode	2021-09-13 16:35:58 -07:00
of_net.c	net: Explicitly include correct DT includes	2023-07-27 20:33:16 -07:00
page_pool.c	net: page_pool: add missing free_percpu when page_pool_init fail	2023-11-20 11:59:34 +01:00
pktgen.c	net: pktgen: Fix interface flags printing	2023-10-18 10:12:30 +01:00
ptp_classifier.c	ptp: Add generic PTP is_sync() function	2022-03-07 11:31:34 +00:00
request_sock.c	tcp: make sure init the accept_queue's spinlocks once	2024-01-31 16:19:00 -08:00
rtnetlink.c	net-sysfs: convert dev->operstate reads to lockless ones	2024-05-17 12:02:23 +02:00
scm.c	io_uring/unix: drop usage of io_uring socket	2024-03-26 18:19:09 -04:00
secure_seq.c	tcp: Fix data-races around sysctl knobs related to SYN option.	2022-07-20 10:14:49 +01:00
selftests.c	net: core: constify mac addrs in selftests	2021-10-24 13:59:44 +01:00
skbuff.c	net: core: reject skb_copy(_expand) for fraglist GSO skbs	2024-05-17 12:02:06 +02:00
skmsg.c	bpf, skmsg: Fix NULL pointer dereference in sk_psock_skb_ingress_enqueue	2024-05-17 12:01:59 +02:00
sock.c	net: mark racy access on sk->sk_rcvbuf	2024-05-17 12:02:10 +02:00
sock_destructor.h	skb_expand_head() adjust skb->truesize incorrectly	2021-10-22 12:35:51 -07:00
sock_diag.c	sock_diag: annotate data-races around sock_diag_handlers[family]	2024-03-26 18:19:22 -04:00
sock_map.c	bpf, sockmap: Prevent lock inversion deadlock in map delete elem	2024-04-10 16:35:51 +02:00
sock_reuseport.c	soreuseport: Fix socket selection for SO_INCOMING_CPU.	2022-10-25 11:35:16 +02:00
stream.c	net: Return error from sk_stream_wait_connect() if sk_wait_event() fails	2024-01-01 12:42:30 +00:00
sysctl_net_core.c	net: make SK_MEMORY_PCPU_RESERV tunable	2024-05-02 16:32:36 +02:00
timestamping.c	net: Introduce a new MII time stamping interface.	2019-12-25 19:51:33 -08:00
tso.c	net: tso: inline tso_count_descs()	2022-12-12 15:04:39 -08:00
utils.c	net: core: inet[46]_pton strlen len types	2022-11-01 21:14:39 -07:00
xdp.c	page_pool: split types and declarations from page_pool.h	2023-08-07 13:05:19 -07:00