Kuniyuki Iwashima 893c49a78d mptcp: Use __sk_dst_get() and dst_dev_rcu() in mptcp_active_enable(). ...

mptcp_active_enable() is called from subflow_finish_connect(),
which is icsk->icsk_af_ops->sk_rx_dst_set() and it's not always
under RCU.

Using sk_dst_get(sk)->dev could trigger UAF.

Let's use __sk_dst_get() and dst_dev_rcu().

Fixes: 27069e7cb3 ("mptcp: disable active MPTCP in case of blackhole")
Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>
Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Link: https://patch.msgid.link/20250916214758.650211-8-kuniyu@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

2025-09-17 18:10:22 -07:00

..

6lowpan

net: replace ND_PRINTK with dynamic debug

2025-07-10 15:27:32 -07:00

9p

netfs: Fix the request's work item to not require a ref

2025-05-21 14:35:20 +02:00

802

treewide, timers: Rename from_timer() to timer_container_of()

2025-06-08 09:07:37 +02:00

8021q

net: s/dev_close_many/netif_close_many/

2025-07-18 17:27:47 -07:00

appletalk

Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

2025-07-24 11:10:46 -07:00

atm

net: atm: fix memory leak in atm_register_sysfs when device_register fail

2025-09-04 09:53:44 +02:00

ax25

ax25: properly unshare skbs in ax25_kiss_rcv()

2025-09-03 17:06:30 -07:00

batman-adv

batman-adv: remove includes for extern declarations

2025-09-05 15:11:02 +02:00

bluetooth

Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen()

2025-08-29 14:51:06 -04:00

bpf

bpf: Add attach_type field to bpf_link

2025-07-11 10:51:55 -07:00

bridge

Merge tag 'nf-next-25-09-11' of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next

2025-09-12 17:06:25 -07:00

caif

caif: Replace memset(0) + strscpy() with strscpy_pad()

2025-08-12 14:08:56 -07:00

can

can: j1939: j1939_local_ecu_get(): undo increment when j1939_local_ecu_get() fails

2025-09-10 17:12:05 +02:00

ceph

libceph: Rename hmac_sha256() to ceph_hmac_sha256()

2025-07-04 10:18:52 -07:00

core

page_pool: always add GFP_NOWARN for ATOMIC allocations

2025-09-15 18:13:49 -07:00

dcb

dcb: Use rtnl_register_many().

2024-10-15 18:52:26 -07:00

devlink

devlink: Add 'total_vfs' generic device param

2025-09-09 19:14:23 -07:00

dns_resolver

…

dsa

net: s/dev_close_many/netif_close_many/

2025-07-18 17:27:47 -07:00

ethernet

ethernet: Extend device_get_mac_address() to use NVMEM

2025-09-15 18:34:08 -07:00

ethtool

net: ethtool: support including Flow Label in the flow hash for RSS

2025-08-14 11:40:13 +02:00

handshake

net/handshake: Add new parameter 'HANDSHAKE_A_ACCEPT_KEYRING'

2025-07-08 15:31:44 +02:00

hsr

Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

2025-09-11 17:40:13 -07:00

ieee802154

treewide, timers: Rename from_timer() to timer_container_of()

2025-06-08 09:07:37 +02:00

ife

…

ipv4

tcp: ecn functions in separated include file

2025-09-15 16:26:33 -07:00

ipv6

Merge tag 'nf-next-25-09-11' of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next

2025-09-12 17:06:25 -07:00

iucv

net: add sk_drops_read(), sk_drops_inc() and sk_drops_reset() helpers

2025-08-28 13:14:50 +02:00

kcm

net: kcm: Fix race condition in kcm_unattach()

2025-08-13 18:18:33 -07:00

key

Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

2025-07-24 11:10:46 -07:00

l2tp

l2tp: do not use sock_hold() in pppol2tp_session_get_sock()

2025-08-27 17:16:13 -07:00

l3mdev

net: fib_rules: Fix iif / oif matching on L3 master device

2025-04-15 17:54:56 -07:00

lapb

treewide, timers: Rename from_timer() to timer_container_of()

2025-06-08 09:07:37 +02:00

llc

net: make sk->sk_rcvtimeo lockless

2025-06-23 17:05:12 -07:00

mac80211

Merge tag 'wireless-next-2025-09-11' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next

2025-09-11 17:50:46 -07:00

mac802154

mac802154: Switch to use hrtimer_setup()

2025-02-18 10:35:44 +01:00

mctp

net: mctp: fix typo in comment

2025-09-08 17:47:57 -07:00

mpls

net: s/dev_get_flags/netif_get_flags/

2025-07-18 17:27:47 -07:00

mptcp

mptcp: Use __sk_dst_get() and dst_dev_rcu() in mptcp_active_enable().

2025-09-17 18:10:22 -07:00

ncsi

net: ncsi: Fix buffer overflow in fetching version id

2025-06-12 18:21:59 -07:00

netfilter

Merge tag 'nf-next-25-09-11' of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next

2025-09-12 17:06:25 -07:00

netlabel

calipso: unlock rcu before returning -EAFNOSUPPORT

2025-06-05 08:03:38 -07:00

netlink

Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

2025-09-11 17:40:13 -07:00

netrom

treewide, timers: Rename from_timer() to timer_container_of()

2025-06-08 09:07:37 +02:00

nfc

Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

2025-06-19 13:00:24 -07:00

nsh

…

openvswitch

net: openvswitch: Use for_each_cpu() where appropriate

2025-08-20 19:47:22 -07:00

packet

net: af_packet: Use hrtimer to do the retire operation

2025-09-11 18:40:06 -07:00

phonet

net: add sk_drops_read(), sk_drops_inc() and sk_drops_reset() helpers

2025-08-28 13:14:50 +02:00

psample

psample: adjust size if rate_as_probability is set

2024-12-18 19:23:04 -08:00

qrtr

net: qrtr: Update packets cloning when broadcasting

2024-09-24 10:48:16 +02:00

rds

rds: ib: Remove unused extern definition

2025-09-08 18:16:49 -07:00

rfkill

net: rfkill: gpio: allow booting in blocked state

2025-02-11 11:55:55 +01:00

rose

net: rose: fix a typo in rose_clear_routes()

2025-08-27 17:27:52 -07:00

rxrpc

rxrpc: Fix to use conn aborts for conn-wide failures

2025-07-17 07:50:48 -07:00

sched

net_sched: act: remove tcfa_qstats

2025-09-02 15:52:24 -07:00

sctp

sctp: snmp: do not use SNMP_MIB_SENTINEL anymore

2025-09-08 18:06:21 -07:00

shaper

net: add netdev_lock() / netdev_unlock() helpers

2025-01-15 19:13:33 -08:00

smc

smc: Use __sk_dst_get() and dst_dev_rcu() in smc_vlan_by_tcpsk().

2025-09-17 18:10:22 -07:00

strparser

net: make sk->sk_rcvtimeo lockless

2025-06-23 17:05:12 -07:00

sunrpc

SUNRPC: call xs_sock_process_cmsg for all cmsg

2025-09-06 16:51:26 -04:00

switchdev

net: switchdev: Convert blocking notification chain to a raw one

2025-03-11 11:30:28 +01:00

tipc

net: add sk_drops_read(), sk_drops_inc() and sk_drops_reset() helpers

2025-08-28 13:14:50 +02:00

tls

tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock().

2025-09-17 18:10:22 -07:00

unix

Merge tag 'net-next-6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next

2025-07-30 08:58:55 -07:00

vmw_vsock

Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

2025-08-29 11:48:01 -07:00

wireless

Merge tag 'wireless-next-2025-09-11' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next

2025-09-11 17:50:46 -07:00

x25

net/x25: Remove unused x25_terminate_link()

2025-07-14 17:19:13 -07:00

xdp

xsk: Fix immature cq descriptor production

2025-09-09 15:09:55 -07:00

xfrm

xfrm: snmp: do not use SNMP_MIB_SENTINEL anymore

2025-09-08 18:06:21 -07:00

compat.c

…

devres.c

…

Kconfig

net: Kconfig: add endif/endmenu comments

2025-07-22 18:17:23 -07:00

Kconfig.debug

rtnetlink: Add per-netns RTNL.

2024-10-08 15:16:59 +02:00

Makefile

net: Retire DCCP socket.

2025-04-11 18:58:10 -07:00

socket.c

net: annotate races around sk->sk_uid

2025-06-23 17:04:03 -07:00

sysctl_net.c

sysctl: Remove check for sentinel element in ctl_table arrays

2024-06-13 10:50:52 +02:00