mirrors/linux
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-04-03 04:05:33 -04:00
Code Issues Packages Projects Releases Wiki Activity
Files
bfd264fbbbca7a39ea430d7bc2baf8ee2ea958e4
linux/net/ipv4
History
Eric Dumazet 858d2a4f67 tcp: fix potential race in tcp_v6_syn_recv_sock() 
Code in tcp_v6_syn_recv_sock() after the call to tcp_v4_syn_recv_sock()
is done too late.

After tcp_v4_syn_recv_sock(), the child socket is already visible
from TCP ehash table and other cpus might use it.

Since newinet->pinet6 is still pointing to the listener ipv6_pinfo
bad things can happen as syzbot found.

Move the problematic code in tcp_v6_mapped_child_init()
and call this new helper from tcp_v4_syn_recv_sock() before
the ehash insertion.

This allows the removal of one tcp_sync_mss(), since
tcp_v4_syn_recv_sock() will call it with the correct
context.

Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Reported-by: syzbot+937b5bbb6a815b3e5d0b@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/netdev/69949275.050a0220.2eeac1.0145.GAE@google.com/
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
Link: https://patch.msgid.link/20260217161205.2079883-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-02-19 14:02:19 -08:00
..
netfilter
ipv4: use dst4_mtu() instead of dst_mtu()
2026-02-02 17:49:29 -08:00
af_inet.c
net: factor-out _sk_charge() helper
2025-11-24 19:49:40 -08:00
ah4.c
net: fill in MODULE_DESCRIPTION()s for ipv4 modules
2024-02-09 14:12:02 -08:00
arp.c
kernel.h: drop hex.h and update all hex.h users
2026-01-20 19:44:19 -08:00
bpf_tcp_ca.c
tcp: Pass flags to __tcp_send_ack
2025-03-17 13:56:38 +00:00
cipso_ipv4.c
cipso: harden use of skb_cow() in cipso_v4_skbuff_setattr()
2026-01-22 11:52:42 +01:00
datagram.c
net: Convert proto callbacks from sockaddr to sockaddr_unsized
2025-11-04 19:10:33 -08:00
devinet.c
ipv4: Fix NULL vs error pointer check in inet_blackhole_dev_init()
2025-09-03 16:58:44 -07:00
esp4_offload.c
xfrm: Fix inner mode lookup in tunnel mode GSO segmentation
2025-12-04 09:54:53 +01:00
esp4.c
tcp: Don't pass hashinfo to socket lookup helpers.
2025-08-25 17:53:35 -07:00
fib_frontend.c
ipv4: Convert ->flowi4_tos to dscp_t.
2025-08-26 17:34:31 -07:00
fib_lookup.h
ipv4: fib: Annotate access to struct fib_alias.fa_state.
2026-01-28 19:33:07 -08:00
fib_notifier.c
net: do not acquire rtnl in fib_seq_sum()
2024-10-11 15:35:05 -07:00
fib_rules.c
ipv4: Convert ->flowi4_tos to dscp_t.
2025-08-26 17:34:31 -07:00
fib_semantics.c
net: fib: restore ECMP balance from loopback
2025-12-30 11:07:38 +01:00
fib_trie.c
ipv4: fib: Annotate access to struct fib_alias.fa_state.
2026-01-28 19:33:07 -08:00
fou_bpf.c
ip_tunnel: convert __be16 tunnel flags to bitmaps
2024-04-01 10:49:28 +01:00
fou_core.c
gue: Fix skb memleak with inner IP protocol 0.
2026-01-17 16:00:23 -08:00
fou_nl.c
fou: Don't allow 0 for FOU_ATTR_IPPROTO.
2026-01-17 16:00:24 -08:00
fou_nl.h
tools: ynl-gen: add regeneration comment
2025-11-25 19:20:42 -08:00
gre_demux.c
net: ip_gre: Fix spelling mistake "demultiplexor" -> "demultiplexer"
2025-04-24 18:20:40 -07:00
gre_offload.c
net: gro: rename skb_gro_header_hard()
2024-03-05 13:30:11 +01:00
icmp.c
ipv4: icmp: icmpv4_xrlim_allow() optimization if net.ipv4.icmp_ratelimit is zero
2026-02-18 16:46:36 -08:00
igmp_internal.h
netlink: support dumping IPv4 multicast addresses
2025-02-11 11:26:53 +01:00
igmp.c
ipv4: igmp: annotate data-races around idev->mr_maxdelay
2026-01-25 14:45:14 -08:00
inet_connection_sock.c
tcp: move __reqsk_free() out of line
2026-02-05 09:23:06 -08:00
inet_diag.c
tcp: introduce icsk->icsk_keepalive_timer
2025-11-25 19:28:29 -08:00
inet_fragment.c
inet: frags: drop fraglist conntrack references
2026-01-04 10:58:04 -08:00
inet_hashtables.c
inet: Avoid ehash lookup race in inet_ehash_insert()
2025-10-17 16:08:43 -07:00
inet_timewait_sock.c
inet: Avoid ehash lookup race in inet_twsk_hashdance_schedule()
2025-10-17 16:08:43 -07:00
inetpeer.c
inetpeer: use EXPORT_IPV6_MOD[_GPL]()
2025-02-14 13:09:39 -08:00
ip_forward.c
net: fix IPSTATS_MIB_OUTFORWDATAGRAMS increment after fragment check
2023-10-13 09:58:45 -07:00
ip_fragment.c
inet: frags: flush pending skbs in fqdir_pre_exit()
2025-12-10 01:15:27 -08:00
ip_gre.c
ipv4: ip_gre: make ipgre_header() robust
2026-01-10 12:06:22 -08:00
ip_input.c
net: ipv4: Remove extern udp_v4_early_demux()/tcp_v4_early_demux() in .c files
2025-10-29 17:05:30 -07:00
ip_options.c
net: Switch to skb_dstref_steal/skb_dstref_restore for ip_route_input callers
2025-08-19 17:54:35 -07:00
ip_output.c
ipv4: use dst4_mtu() instead of dst_mtu()
2026-02-02 17:49:29 -08:00
ip_sockglue.c
ipv4: use dst4_mtu() instead of dst_mtu()
2026-02-02 17:49:29 -08:00
ip_tunnel_core.c
tunnels: reset the GSO metadata before reusing the skb
2025-09-09 13:03:33 +02:00
ip_tunnel.c
ipv4: ip_tunnel: spread netdev_lockdep_set_classes()
2026-01-08 18:02:35 -08:00
ip_vti.c
ipv4: adopt dst_dev, skb_dst_dev and skb_dst_dev_net[_rcu]
2025-07-02 14:32:30 -07:00
ipcomp.c
xfrm: delete x->tunnel as we delete x
2025-07-08 13:28:27 +02:00
ipconfig.c
net: ipconfig: Remove outdated comment and indent code block
2026-01-12 19:11:35 -08:00
ipip.c
netfilter: flowtable: Add IPIP rx sw acceleration
2025-11-28 00:00:38 +00:00
ipmr_base.c
ipmr: do not call mr_mfc_uses_dev() for unres entries
2025-01-23 07:08:13 -08:00
ipmr.c
ipv4: use dst4_mtu() instead of dst_mtu()
2026-02-02 17:49:29 -08:00
Kconfig
tcp: Convert tcp-md5 to use MD5 library instead of crypto_ahash
2025-10-17 17:14:54 -07:00
Makefile
tcp: move tcp_rate_check_app_limited() to tcp.c
2026-01-22 18:28:48 -08:00
metrics.c
ipv4: Use EXPORT_IPV6_MOD_GPL() for ip_fib_metrics_init().
2026-01-28 19:33:38 -08:00
netfilter.c
ipv4: Convert ->flowi4_tos to dscp_t.
2025-08-26 17:34:31 -07:00
netlink.c
…
nexthop.c
Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
2025-09-25 11:00:59 -07:00
ping.c
ping: annotate data-races in ping_lookup()
2026-02-17 17:11:08 -08:00
proc.c
ipv4: snmp: do not use SNMP_MIB_SENTINEL anymore
2025-09-08 18:06:20 -07:00
protocol.c
…
raw_diag.c
inet_diag: change inet_diag_bc_sk() first argument
2025-08-29 19:29:24 -07:00
raw.c
ipv4/inet_sock.h: Avoid thousands of -Wflex-array-member-not-at-end warnings
2026-01-06 17:02:52 -08:00
route.c
Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
2026-01-15 18:02:48 -08:00
syncookies.c
tcp: fix potential race in tcp_v6_syn_recv_sock()
2026-02-19 14:02:19 -08:00
sysctl_net_ipv4.c
tcp: accecn: enable AccECN
2026-02-03 15:13:25 +01:00
tcp_ao.c
Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
2025-09-18 11:26:06 -07:00
tcp_bbr.c
tcp: Add new args for cong_control in tcp_congestion_ops
2024-05-02 16:26:56 -07:00
tcp_bic.c
tcp: add accessors to read/set tp->snd_cwnd
2022-04-06 12:05:41 -07:00
tcp_bpf.c
bpf, sockmap: Fix FIONREAD for sockmap
2026-01-27 09:11:30 -08:00
tcp_cdg.c
tcp: cdg: remove redundant __GFP_NOWARN
2025-08-12 14:05:43 -07:00
tcp_cong.c
tcp: ECT_1_NEGOTIATION and NEEDS_ACCECN identifiers
2026-02-03 15:13:24 +01:00
tcp_cubic.c
tcp_cubic: fix incorrect HyStart round start detection
2025-01-20 12:26:41 +00:00
tcp_dctcp.c
tcp: helpers for ECN mode handling
2025-03-17 13:54:11 +00:00
tcp_dctcp.h
tcp: Pass flags to __tcp_send_ack
2025-03-17 13:56:38 +00:00
tcp_diag.c
inet_diag: change inet_diag_bc_sk() first argument
2025-08-29 19:29:24 -07:00
tcp_fastopen.c
tcp: fix potential race in tcp_v6_syn_recv_sock()
2026-02-19 14:02:19 -08:00
tcp_highspeed.c
tcp: add accessors to read/set tp->snd_cwnd
2022-04-06 12:05:41 -07:00
tcp_htcp.c
tcp: Use clamp() in htcp_alpha_update()
2024-08-06 12:16:25 -07:00
tcp_hybla.c
tcp: add accessors to read/set tp->snd_cwnd
2022-04-06 12:05:41 -07:00
tcp_illinois.c
tcp: add accessors to read/set tp->snd_cwnd
2022-04-06 12:05:41 -07:00
tcp_input.c
tcp: split tcp_check_space() in two parts
2026-02-04 20:37:06 -08:00
tcp_ipv4.c
tcp: fix potential race in tcp_v6_syn_recv_sock()
2026-02-19 14:02:19 -08:00
tcp_lp.c
net: tcp_lp: fix kernel-doc warnings and update outdated reference links
2025-10-28 17:52:44 -07:00
tcp_metrics.c
Merge tag 'net-next-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next
2025-10-02 15:17:01 -07:00
tcp_minisocks.c
tcp: fix potential race in tcp_v6_syn_recv_sock()
2026-02-19 14:02:19 -08:00
tcp_nv.c
tcp: add accessors to read/set tp->snd_cwnd
2022-04-06 12:05:41 -07:00
tcp_offload.c
gro: flushing when CWR is set negatively affects AccECN
2026-02-03 15:13:24 +01:00
tcp_output.c
tcp: move tcp_rbtree_insert() to tcp_output.c
2026-02-04 20:36:50 -08:00
tcp_plb.c
prandom: remove prandom_u32_max()
2022-12-20 03:13:45 +01:00
tcp_recovery.c
tcp: move tcp_rack_advance() to tcp_input.c
2026-01-28 19:31:51 -08:00
tcp_scalable.c
tcp: add accessors to read/set tp->snd_cwnd
2022-04-06 12:05:41 -07:00
tcp_sigpool.c
compiler-context-analysis: Change __cond_acquires to take return value
2026-01-05 16:43:29 +01:00
tcp_timer.c
tcp: accecn: unset ECT if receive or send ACE=0 in AccECN negotiaion
2026-02-03 15:13:24 +01:00
tcp_ulp.c
net/ulp: use consistent error code when blocking ULP
2023-01-19 09:26:16 -08:00
tcp_vegas.c
tcp: add accessors to read/set tp->snd_cwnd
2022-04-06 12:05:41 -07:00
tcp_vegas.h
…
tcp_veno.c
tcp: add accessors to read/set tp->snd_cwnd
2022-04-06 12:05:41 -07:00
tcp_westwood.c
tcp: add accessors to read/set tp->snd_cwnd
2022-04-06 12:05:41 -07:00
tcp_yeah.c
tcp: add accessors to read/set tp->snd_cwnd
2022-04-06 12:05:41 -07:00
tcp.c
tcp: accecn: add tcpi_ecn_mode and tcpi_option2 in tcp_info
2026-02-03 15:13:25 +01:00
tunnel4.c
net: fill in MODULE_DESCRIPTION()s for ipv4 modules
2024-02-09 14:12:02 -08:00
udp_bpf.c
bpf, sockmap: Fix FIONREAD for sockmap
2026-01-27 09:11:30 -08:00
udp_diag.c
inet_diag: change inet_diag_bc_sk() first argument
2025-08-29 19:29:24 -07:00
udp_impl.h
udp: move udp_memory_allocated into net_aligned_data
2025-07-02 14:22:02 -07:00
udp_offload.c
Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
2026-01-29 17:28:54 -08:00
udp_tunnel_core.c
net: Convert proto_ops connect() callbacks to use sockaddr_unsized
2025-11-04 19:10:32 -08:00
udp_tunnel_nic.c
udp_tunnel: use netdev_warn() instead of netdev_WARN()
2025-09-11 19:09:48 -07:00
udp_tunnel_stub.c
…
udp.c
udp: add drop count for packets in udp_prod_queue
2026-01-30 17:18:53 -08:00
udplite.c
udp: move udp_memory_allocated into net_aligned_data
2025-07-02 14:22:02 -07:00
xfrm4_input.c
xfrm: Set transport header to fix UDP GRO handling
2025-07-02 09:19:56 +02:00
xfrm4_output.c
ipv4: adopt dst_dev, skb_dst_dev and skb_dst_dev_net[_rcu]
2025-07-02 14:32:30 -07:00
xfrm4_policy.c
ipv4: Convert ->flowi4_tos to dscp_t.
2025-08-26 17:34:31 -07:00
xfrm4_protocol.c
ipv4: Convert ip_route_input_noref() to dscp_t.
2024-10-03 16:21:21 -07:00
xfrm4_state.c
…
xfrm4_tunnel.c
net: fill in MODULE_DESCRIPTION()s for ipv4 modules
2024-02-09 14:12:02 -08:00