Catcrafts/milos-linux
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
milos-linux/net
History
Kyle Zeng f7f2fbb0e8 netfilter: x_tables: avoid leaking percpu counter pointers 
The native and compat get-entries paths copy the fixed rule entry header
from the kernelized rule blob to userspace before overwriting the entry's
counter fields with a sanitized counter snapshot.

On SMP kernels, entry->counters.pcnt contains the percpu allocation
address used by x_tables rule counters. A caller can provide a userspace
buffer that faults during the initial fixed-header copy after pcnt has
been copied but before the later sanitized counter copy runs. The syscall
then returns -EFAULT while leaving the raw percpu pointer in userspace.

Copy only the fixed entry prefix before counters from the kernelized rule
blob, then copy the sanitized counter snapshot into the counter field.
Apply this ordering to the IPv4, IPv6, and ARP native and compat
get-entries implementations so a fault cannot expose the internal percpu
counter pointer.

Fixes: 71ae0dff02 ("netfilter: xtables: use percpu rule counters")
Signed-off-by: Kyle Zeng <kylebot@openai.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2026-06-10 17:59:01 +02:00
..
6lowpan 6lowpan: fix off-by-one in multicast context address compression 2026-06-01 19:10:16 -07:00
9p 9p/trans_xen: replace simple_strto* with kstrtouint 2026-04-16 02:57:01 +00:00
802 net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr 2026-06-04 08:52:41 -07:00
8021q 8021q: delete cleared egress QoS mappings 2026-04-23 12:13:57 +02:00
appletalk appletalk: aarp: zero-initialize aarp_entry to prevent heap info leak 2026-06-03 18:08:58 -07:00
atm net: atm: fix skb leak in sigd_send() default branch 2026-05-12 18:07:02 -07:00
batman-adv batman-adv: bla: avoid NULL-ptr deref for claim via dropped interface 2026-05-19 10:43:54 +02:00
bluetooth Bluetooth: MGMT: Fix backward compatibility with userspace 2026-06-03 11:24:12 -04:00
bpf bpf: reject short IPv4/IPv6 inputs in bpf_prog_test_run_skb 2026-04-12 15:42:57 -07:00
bridge netfilter: revalidate bridge ports 2026-06-10 17:58:20 +02:00
can Networking changes for 7.1. 2026-04-14 18:36:10 -07:00
ceph libceph: Fix potential null-ptr-deref in decode_choose_args() 2026-05-12 21:00:59 +02:00
core net: Annotate sk->sk_write_space() for UDP SOCKMAP. 2026-06-02 11:44:43 -07:00
dcb
devlink devlink: Release nested relation on devlink free 2026-06-01 19:54:52 -07:00
dns_resolver net: Add SPDX ids to some source files 2026-03-09 18:32:45 -07:00
dsa net: dsa: remove redundant netdev_lock_ops() from conduit ethtool ops 2026-04-16 19:10:48 -07:00
ethernet bonding: prevent potential infinite loop in bond_header_parse() 2026-03-16 19:29:45 -07:00
ethtool ethtool: eeprom: add more safeties to EEPROM Netlink fallback 2026-05-27 17:42:09 -07:00
handshake net/handshake: Drain pending requests at net namespace exit 2026-05-28 13:35:32 +02:00
hsr hsr: Remove WARN_ONCE() in hsr_addr_is_self(). 2026-06-02 12:04:52 -07:00
ieee802154 ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit() 2026-06-04 08:51:32 -07:00
ife
ipv4 netfilter: x_tables: avoid leaking percpu counter pointers 2026-06-10 17:59:01 +02:00
ipv6 netfilter: x_tables: avoid leaking percpu counter pointers 2026-06-10 17:59:01 +02:00
iucv net/iucv: fix locking in .getsockopt 2026-05-22 17:40:32 -07:00
kcm
key xfrm: route MIGRATE notifications to caller's netns 2026-05-07 09:31:10 +02:00
l2tp l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl() 2026-06-01 19:40:46 -07:00
l3mdev
lapb
llc llc: Return -EINPROGRESS from llc_ui_connect() 2026-04-23 11:40:39 -07:00
mac80211 wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap 2026-06-02 13:26:33 +02:00
mac802154 bonding: prevent potential infinite loop in bond_header_parse() 2026-03-16 19:29:45 -07:00
mctp net: mctp: test: Use dev_direct_xmit for TX to our test device 2026-04-30 13:36:47 -07:00
mpls Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2026-04-02 11:03:13 -07:00
mptcp mptcp: add-addr: always drop other suboptions 2026-06-03 19:04:27 -07:00
ncsi net: ncsi: fix skb leak in error paths 2026-03-06 17:34:48 -08:00
netfilter netfilter: nf_conntrack: destroy stale expectfn expectations on unregister 2026-06-10 17:58:39 +02:00
netlabel
netlink net: netlink: don't set nsid on local notifications 2026-05-22 17:11:09 -07:00
nfc nfc: hci: fix out-of-bounds read in HCP header parsing 2026-05-07 12:42:09 +02:00
nsh
openvswitch openvswitch: vport: fix race between linking and the device notifier 2026-05-18 16:38:45 -07:00
packet net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd() 2026-04-22 20:16:34 -07:00
phonet phonet/pep: disable BH around forwarded sk_receive_skb() 2026-05-21 07:38:21 -07:00
psample
psp psp: strip variable-length PSP header in psp_dev_rcv() 2026-05-04 19:25:14 -07:00
qrtr Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2026-04-14 12:04:00 -07:00
rds net: rds: clear i_sends on setup unwind 2026-06-02 13:31:27 -07:00
rfkill net: rfkill: prevent unlimited numbers of rfkill events from being created 2026-04-07 12:35:04 +02:00
rxrpc rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer 2026-05-20 16:36:45 -07:00
sched net/sched: fix pedit partial COW leading to page cache corruption 2026-06-04 08:29:02 -07:00
sctp sctp: purge outqueue on stale COOKIE-ECHO handling 2026-06-04 09:01:25 -07:00
shaper net: shaper: rework the VALID marking (again) 2026-05-20 16:34:20 -07:00
smc net/smc: Do not re-initialize smc hashtables 2026-05-22 17:38:02 -07:00
strparser net: strparser: fix skb_head leak in strp_abort_strp() 2026-04-14 12:37:00 +02:00
sunrpc nfsd-7.1 fixes: 2026-05-26 13:49:13 -07:00
switchdev bridge: No DEV_PATH_BR_VLAN_UNTAG_HW for dsa foreign 2026-03-19 13:14:00 +01:00
tipc Including fixes from Netfilter. 2026-04-23 16:50:42 -07:00
tls tls: Preserve sk_err across recvmsg() when data has been copied 2026-05-14 18:19:44 -07:00
unix af_unix: Fix inq_len update problem in partial read 2026-06-03 18:52:25 -07:00
vmw_vsock vsock/vmci: fix sk_ack_backlog leak on failed handshake 2026-06-04 13:08:02 +02:00
wireless wifi: cfg80211: enforce HE/EHT cap/oper consistency 2026-06-03 13:25:19 +02:00
x25 vfs-7.1-rc1.kino 2026-04-13 12:19:01 -07:00
xdp xsk: cache csum_start/csum_offset to fix TOCTOU in xsk_skb_metadata() 2026-06-03 17:45:42 -07:00
xfrm xfrm: input: hold netns during deferred transport reinjection 2026-05-26 10:35:30 +02:00
compat.c
devres.c
Kconfig net: remove ax25 and amateur radio (hamradio) subsystem 2026-04-23 10:24:02 -07:00
Kconfig.debug
Makefile net: remove ax25 and amateur radio (hamradio) subsystem 2026-04-23 10:24:02 -07:00
socket.c Networking changes for 7.1. 2026-04-14 18:36:10 -07:00
sysctl_net.c