Xuanqiang Luo d0f86fb36e udp: fix potential use-after-free in tunnel segmentation ...

__skb_udp_tunnel_segment() gets the UDP header before ensuring the
tunnel header is in the skb head. If the pull reallocates skb->head,
the saved UDP header pointer is no longer valid.

Get the UDP header after the pull to avoid a potential use-after-free.

Fixes: dbef491ebe ("udp: Use uh->len instead of skb->len to compute checksum in segmentation")
Signed-off-by: Xuanqiang Luo <luoxuanqiang@kylinos.cn>
Reviewed-by: Antoine Tenart <atenart@kernel.org>
Link: https://patch.msgid.link/20260730093554.68127-1-xuanqiang.luo@linux.dev
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

2026-08-03 18:32:47 -07:00

..

netfilter

netfilter: nf_conntrack_expect: add and use nf_ct_expect_related_pair()

2026-07-22 20:34:28 +02:00

af_inet.c

ipv4: remove obsolete EXPORT_SYMBOL() and EXPORT_SYMBOL_GPL()

2026-06-05 17:47:07 -07:00

ah4.c

xfrm: ah: use skb_to_full_sk in async output callbacks

2026-05-16 10:56:14 +02:00

arp.c

net: remove ax25 and amateur radio (hamradio) subsystem

2026-04-23 10:24:02 -07:00

bpf_tcp_ca.c

bpf: Reject TCP_NODELAY in bpf-tcp-cc

2026-04-22 12:58:57 -07:00

cipso_ipv4.c

Convert remaining multi-line kmalloc_obj/flex GFP_KERNEL uses

2026-02-22 08:26:33 -08:00

datagram.c

raw: annotate lockless match fields in raw_v4_match()

2026-07-23 07:46:12 -07:00

devinet.c

ipv4: handle devconf post-set actions on netlink updates

2026-06-13 14:15:53 -07:00

esp4_offload.c

xfrm: Fix inner mode lookup in tunnel mode GSO segmentation

2025-12-04 09:54:53 +01:00

esp4.c

esp: fix page frag reference leak on skb_to_sgvec failure

2026-06-09 15:58:17 +02:00

fib_frontend.c

ipv4: fib_rule: Move fib4_rules_exit() to ->exit().

2026-06-16 15:42:53 -07:00

fib_lookup.h

ipv4: fib: Annotate access to struct fib_alias.fa_state.

2026-01-28 19:33:07 -08:00

fib_notifier.c

net: do not acquire rtnl in fib_seq_sum()

2024-10-11 15:35:05 -07:00

fib_rules.c

ipv4: fib_rule: Move fib4_rules_exit() to ->exit().

2026-06-16 15:42:53 -07:00

fib_semantics.c

ipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops

2026-08-03 18:29:50 -07:00

fib_trie.c

ipv4: fib: free fib_alias with kfree_rcu() on insert error path

2026-07-10 16:00:41 +02:00

fou_bpf.c

ip_tunnel: convert __be16 tunnel flags to bitmaps

2024-04-01 10:49:28 +01:00

fou_core.c

fou: Fix use-after-free in fou_create()

2026-07-28 10:40:48 +02:00

fou_nl.c

fou: Don't allow 0 for FOU_ATTR_IPPROTO.

2026-01-17 16:00:24 -08:00

fou_nl.h

tools: ynl-gen: add regeneration comment

2025-11-25 19:20:42 -08:00

gre_demux.c

gre: Count GRE packet drops

2026-04-12 12:33:33 -07:00

gre_offload.c

net: gro: rename skb_gro_header_hard()

2024-03-05 13:30:11 +01:00

icmp.c

ipv4: icmp: fill flow parameters in icmp_route_lookup decoy lookup

2026-07-23 07:01:24 -07:00

igmp_internal.h

netlink: support dumping IPv4 multicast addresses

2025-02-11 11:26:53 +01:00

igmp.c

ipv4: igmp: Fix potential memory leaks in igmp_mod_timer() and igmp_stop_timer()

2026-07-08 14:41:01 +02:00

inet_connection_sock.c

Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

2026-06-16 14:59:58 -07:00

inet_diag.c

inet_diag: report delayed ack timer information

2026-03-06 16:32:26 -08:00

inet_fragment.c

inet: frags: publish queues before arming timer

2026-07-31 17:05:07 -07:00

inet_hashtables.c

net: remove some unused EXPORT_SYMBOL()s

2026-06-12 16:43:11 -07:00

inet_timewait_sock.c

inet: Avoid ehash lookup race in inet_twsk_hashdance_schedule()

2025-10-17 16:08:43 -07:00

inetpeer.c

inetpeer: add a missing read_seqretry() in inet_getpeer()

2026-05-06 17:44:13 -07:00

ip_forward.c

net: fix IPSTATS_MIB_OUTFORWDATAGRAMS increment after fragment check

2023-10-13 09:58:45 -07:00

ip_fragment.c

inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush

2026-06-04 18:05:23 -07:00

ip_gre.c

net: gre: fix lltx regression for GRE tunnels with SEQ/CSUM

2026-07-23 13:01:57 +02:00

ip_input.c

tcp: move tcp_v4_early_demux() to net/ipv4/ip_input.c

2026-03-09 18:50:24 -07:00

ip_options.c

ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options

2026-06-03 18:53:14 -07:00

ip_output.c

ipv4: account for fraggap on the paged allocation path

2026-06-21 15:24:49 -07:00

ip_sockglue.c

net: remove addr_len argument of recvmsg() handlers

2026-03-02 18:17:17 -08:00

ip_tunnel_core.c

tunnels: do not assume transport header in iptunnel_pmtud_check_icmp()

2026-05-26 18:11:47 -07:00

ip_tunnel.c

ip_tunnel: annotate data-races around t->err_count and t->err_time

2026-06-12 16:40:32 -07:00

ip_vti.c

net: ip_vti: require CAP_NET_ADMIN in the device netns for changelink

2026-06-17 16:01:52 -07:00

ipcomp.c

xfrm: add extack to xfrm_init_state

2026-06-04 12:22:35 +02:00

ipconfig.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

ipip.c

net: ipip: require CAP_NET_ADMIN in the device netns for changelink

2026-06-17 16:01:52 -07:00

ipmr_base.c

ipmr: Replace use of system_unbound_wq with system_dfl_wq

2026-05-19 18:21:39 -07:00

ipmr.c

ipmr: Convert mr_table.cache_resolve_queue_len to u32.

2026-06-11 15:17:30 -07:00

Kconfig

net/tcp: Remove tcp_sigpool

2026-04-30 09:38:56 +02:00

Makefile

netfilter: add option for GCOV profiling

2026-05-24 22:55:47 +02:00

metrics.c

net: remove EXPORT_IPV6_MOD() and EXPORT_IPV6_MOD_GPL() macros

2026-03-29 11:21:22 -07:00

netfilter.c

net: Add SPDX ids to some source files

2026-03-09 18:32:45 -07:00

netlink.c

…

nexthop.c

nexthop: avoid unlocked f6i_list walk in nh_rt_cache_flush

2026-07-24 15:00:56 -07:00

ping.c

Merge tag 'net-next-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next

2026-04-14 18:36:10 -07:00

proc.c

udp: Remove UDP-Lite SNMP stats.

2026-03-13 18:57:44 -07:00

protocol.c

…

raw_diag.c

inet_diag: change inet_diag_bc_sk() first argument

2025-08-29 19:29:24 -07:00

raw.c

raw: annotate lockless match fields in raw_v4_match()

2026-07-23 07:46:12 -07:00

route.c

net: do not send ICMP/NDISC Redirects when peer allocation fails

2026-07-27 13:54:16 -07:00

syncookies.c

tcp: rehash onto different local ECMP path on retransmit timeout

2026-06-15 15:57:31 -07:00

sysctl_net_ipv4.c

net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes

2026-06-17 16:35:13 -07:00

tcp_ao.c

tcp: restore RCU grace period in tcp_ao_destroy_sock

2026-06-29 18:14:30 -07:00

tcp_bbr.c

tcp_bbr: fix SPDX-License-Identifier to be GPL-2.0 OR BSD-3-Clause

2026-06-01 16:51:08 -07:00

tcp_bic.c

tcp: annotate data-races around tp->snd_ssthresh

2026-04-18 11:10:12 -07:00

tcp_bpf.c

bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg()

2026-07-24 15:04:11 -07:00

tcp_cdg.c

tcp: annotate data-races around tp->snd_ssthresh

2026-04-18 11:10:12 -07:00

tcp_cong.c

tcp: ECT_1_NEGOTIATION and NEEDS_ACCECN identifiers

2026-02-03 15:13:24 +01:00

tcp_cubic.c

tcp: annotate data-races around tp->snd_ssthresh

2026-04-18 11:10:12 -07:00

tcp_dctcp.c

tcp: annotate data-races around tp->snd_ssthresh

2026-04-18 11:10:12 -07:00

tcp_dctcp.h

net: Add SPDX ids to some source files

2026-03-09 18:32:45 -07:00

tcp_diag.c

inet_diag: report delayed ack timer information

2026-03-06 16:32:26 -08:00

tcp_fastopen.c

net: remove EXPORT_IPV6_MOD() and EXPORT_IPV6_MOD_GPL() macros

2026-03-29 11:21:22 -07:00

tcp_highspeed.c

tcp: add accessors to read/set tp->snd_cwnd

2022-04-06 12:05:41 -07:00

tcp_htcp.c

tcp: Use clamp() in htcp_alpha_update()

2024-08-06 12:16:25 -07:00

tcp_hybla.c

tcp: add accessors to read/set tp->snd_cwnd

2022-04-06 12:05:41 -07:00

tcp_illinois.c

tcp: add accessors to read/set tp->snd_cwnd

2022-04-06 12:05:41 -07:00

tcp_input.c

tcp: do not change rcv_ssthresh in tcp_measure_rcv_mss()

2026-08-03 14:20:45 -07:00

tcp_ipv4.c

bpf: tcp: fix double sock release on batch realloc

2026-07-23 12:20:34 +02:00

tcp_lp.c

net: tcp_lp: fix kernel-doc warnings and update outdated reference links

2025-10-28 17:52:44 -07:00

tcp_metrics.c

tcp: annotate data-races around tp->snd_ssthresh

2026-04-18 11:10:12 -07:00

tcp_minisocks.c

tcp: challenge ACK for non-exact RST in SYN-RECEIVED

2026-07-23 08:27:22 -07:00

tcp_nv.c

tcp: annotate data-races around tp->snd_ssthresh

2026-04-18 11:10:12 -07:00

tcp_offload.c

gro: flushing when CWR is set negatively affects AccECN

2026-02-03 15:13:24 +01:00

tcp_output.c

tcp: Decrement tcp_md5_needed static branch

2026-06-29 18:14:30 -07:00

tcp_plb.c

tcp: rehash onto different local ECMP path on retransmit timeout

2026-06-15 15:57:31 -07:00

tcp_recovery.c

tcp: move tcp_rack_advance() to tcp_input.c

2026-01-28 19:31:51 -08:00

tcp_scalable.c

tcp: add accessors to read/set tp->snd_cwnd

2022-04-06 12:05:41 -07:00

tcp_timer.c

tcp: rehash onto different local ECMP path on retransmit timeout

2026-06-15 15:57:31 -07:00

tcp_ulp.c

net/ulp: use consistent error code when blocking ULP

2023-01-19 09:26:16 -08:00

tcp_vegas.c

tcp: annotate data-races around tp->snd_ssthresh

2026-04-18 11:10:12 -07:00

tcp_vegas.h

tcp: add cwnd_event_tx_start to tcp_congestion_ops

2026-03-24 21:00:38 -07:00

tcp_veno.c

tcp: add cwnd_event_tx_start to tcp_congestion_ops

2026-03-24 21:00:38 -07:00

tcp_westwood.c

tcp: annotate data-races around tp->snd_ssthresh

2026-04-18 11:10:12 -07:00

tcp_yeah.c

tcp: annotate data-races around tp->snd_ssthresh

2026-04-18 11:10:12 -07:00

tcp.c

net: remove some unused EXPORT_SYMBOL()s

2026-06-12 16:43:11 -07:00

tunnel4.c

net: fill in MODULE_DESCRIPTION()s for ipv4 modules

2024-02-09 14:12:02 -08:00

udp_bpf.c

sockmap: Fix use-after-free in udp_bpf_recvmsg()

2026-06-14 21:30:20 -07:00

udp_diag.c

udp: Don't pass udptable to IPv4 socket lookup functions.

2026-03-13 18:57:46 -07:00

udp_offload.c

udp: fix potential use-after-free in tunnel segmentation

2026-08-03 18:32:47 -07:00

udp_tunnel_core.c

udp_tunnel: Remove synchronize_rcu() in udp_tunnel_sock_release().

2026-05-05 17:47:06 -07:00

udp_tunnel_nic.c

net: udp_tunnel: fix memory leak in udp_tunnel_nic_unregister()

2026-07-28 13:32:34 +02:00

udp_tunnel_stub.c

…

udp.c

udp: clear skb->dev before running a sockmap verdict

2026-06-04 09:01:51 -07:00

xfrm4_input.c

xfrm: Fix dev use-after-free in xfrm async resumption

2026-06-12 08:39:59 +02:00

xfrm4_output.c

ipv4: adopt dst_dev, skb_dst_dev and skb_dst_dev_net[_rcu]

2025-07-02 14:32:30 -07:00

xfrm4_policy.c

ipv4: Convert ->flowi4_tos to dscp_t.

2025-08-26 17:34:31 -07:00

xfrm4_protocol.c

ipv4: Convert ip_route_input_noref() to dscp_t.

2024-10-03 16:21:21 -07:00

xfrm4_state.c

…

xfrm4_tunnel.c

net: fill in MODULE_DESCRIPTION()s for ipv4 modules

2024-02-09 14:12:02 -08:00