1. 25 Aug, 2022 3 commits
    • Siddh Raman Pant's avatar
      wifi: mac80211: Fix UAF in ieee80211_scan_rx() · 60deb9f1
      Siddh Raman Pant authored
      ieee80211_scan_rx() tries to access scan_req->flags after a
      null check, but a UAF is observed when the scan is completed
      and __ieee80211_scan_completed() executes, which then calls
      cfg80211_scan_done() leading to the freeing of scan_req.
      
      Since scan_req is rcu_dereference()'d, prevent the racing in
      __ieee80211_scan_completed() by ensuring that from mac80211's
      POV it is no longer accessed from an RCU read critical section
      before we call cfg80211_scan_done().
      
      Cc: stable@vger.kernel.org
      Link: https://syzkaller.appspot.com/bug?extid=f9acff9bf08a845f225d
      Reported-by: syzbot+f9acff9bf08a845f225d@syzkaller.appspotmail.com
      Suggested-by: default avatarJohannes Berg <johannes@sipsolutions.net>
      Signed-off-by: default avatarSiddh Raman Pant <code@siddh.me>
      Link: https://lore.kernel.org/r/20220819200340.34826-1-code@siddh.meSigned-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
      60deb9f1
    • Jakub Kicinski's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf · 24c7a64e
      Jakub Kicinski authored
      Pablo Neira Ayuso says:
      
      ====================
      Netfilter fixes for net
      
      1) Fix crash with malformed ebtables blob which do not provide all
         entry points, from Florian Westphal.
      
      2) Fix possible TCP connection clogging up with default 5-days
         timeout in conntrack, from Florian.
      
      3) Fix crash in nf_tables tproxy with unsupported chains, also from Florian.
      
      4) Do not allow to update implicit chains.
      
      5) Make table handle allocation per-netns to fix data race.
      
      6) Do not truncated payload length and offset, and checksum offset.
         Instead report EINVAl.
      
      7) Enable chain stats update via static key iff no error occurs.
      
      8) Restrict osf expression to ip, ip6 and inet families.
      
      9) Restrict tunnel expression to netdev family.
      
      10) Fix crash when trying to bind again an already bound chain.
      
      11) Flowtable garbage collector might leave behind pending work to
          delete entries. This patch comes with a previous preparation patch
          as dependency.
      
      12) Allow net.netfilter.nf_conntrack_frag6_high_thresh to be lowered,
          from Eric Dumazet.
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf:
        netfilter: nf_defrag_ipv6: allow nf_conntrack_frag6_high_thresh increases
        netfilter: flowtable: fix stuck flows on cleanup due to pending work
        netfilter: flowtable: add function to invoke garbage collection immediately
        netfilter: nf_tables: disallow binding to already bound chain
        netfilter: nft_tunnel: restrict it to netdev family
        netfilter: nft_osf: restrict osf to ipv4, ipv6 and inet families
        netfilter: nf_tables: do not leave chain stats enabled on error
        netfilter: nft_payload: do not truncate csum_offset and csum_type
        netfilter: nft_payload: report ERANGE for too long offset and length
        netfilter: nf_tables: make table handle allocation per-netns friendly
        netfilter: nf_tables: disallow updates of implicit chain
        netfilter: nft_tproxy: restrict to prerouting hook
        netfilter: conntrack: work around exceeded receive window
        netfilter: ebtables: reject blobs that don't provide all entry points
      ====================
      
      Link: https://lore.kernel.org/r/20220824220330.64283-1-pablo@netfilter.orgSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      24c7a64e
    • Lukas Bulwahn's avatar
      MAINTAINERS: rectify file entry in BONDING DRIVER · b09da012
      Lukas Bulwahn authored
      Commit c078290a ("selftests: include bonding tests into the kselftest
      infra") adds the bonding tests in the directory:
      
        tools/testing/selftests/drivers/net/bonding/
      
      The file entry in MAINTAINERS for the BONDING DRIVER however refers to:
      
        tools/testing/selftests/net/bonding/
      
      Hence, ./scripts/get_maintainer.pl --self-test=patterns complains about a
      broken file pattern.
      
      Repair this file entry in BONDING DRIVER.
      Signed-off-by: default avatarLukas Bulwahn <lukas.bulwahn@gmail.com>
      Acked-by: default avatarJonathan Toppins <jtoppins@redhat.com>
      Link: https://lore.kernel.org/r/20220824072945.28606-1-lukas.bulwahn@gmail.comSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      b09da012
  2. 24 Aug, 2022 35 commits
  3. 23 Aug, 2022 2 commits