Budimir Markovic f138be5d7f vsock: Do not allow binding to VMADDR_PORT_ANY ... commit aba0c94f61ec05315fa7815d21aefa4c87f6a9f4 upstream. It is possible for a vsock to autobind to VMADDR_PORT_ANY. This can cause a use-after-free when a connection is made to the bound socket. The socket returned by accept() also has port VMADDR_PORT_ANY but is not on the list of unbound sockets. Binding it will result in an extra refcount decrement similar to the one fixed in fcdd2242c0 (vsock: Keep the binding until socket destruction). Modify the check in __vsock_bind_connectible() to also prevent binding to VMADDR_PORT_ANY. Fixes: d021c34405 ("VSOCK: Introduce VM Sockets") Reported-by: Budimir Markovic <markovicbudimir@gmail.com> Signed-off-by: Budimir Markovic <markovicbudimir@gmail.com> Reviewed-by: Stefano Garzarella <sgarzare@redhat.com> Link: https://patch.msgid.link/20250807041811.678-1-markovicbudimir@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2025-08-15 12:05:11 +02:00
..
6lowpan
9p	9p/net: fix improper handling of bogus negative read/write replies	2025-05-02 07:47:04 +02:00
802
8021q	net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime	2025-07-24 08:51:53 +02:00
appletalk	net: appletalk: Fix use-after-free in AARP proxy probe	2025-08-15 12:04:47 +02:00
atm	atm: clip: Fix NULL pointer dereference in vcc_sendmsg()	2025-07-17 18:32:06 +02:00
ax25
batman-adv	batman-adv: Ignore own maximum aggregation size during RX	2025-03-28 21:59:01 +01:00
bluetooth	Bluetooth: HCI: Set extended advertising data synchronously	2025-07-24 08:51:55 +02:00
bpf	bpf, test_run: Fix use-after-free issue in eth_skb_pkt_type()	2025-03-07 16:56:37 +01:00
bpfilter
bridge	net: bridge: Do not offload IGMP/MLD messages	2025-07-24 08:51:53 +02:00
caif	caif: reduce stack size, again	2025-08-15 12:04:56 +02:00
can	can: bcm: add missing rcu read protection for procfs content	2025-06-04 14:40:20 +02:00
ceph
core	netpoll: prevent hanging NAPI when netcons gets enabled	2025-08-15 12:05:09 +02:00
dcb
dccp
devlink
dns_resolver
dsa	net: dsa: tag_brcm: legacy: fix pskb_may_pull length	2025-06-27 11:07:17 +01:00
ethernet
ethtool	net: ethtool: Don't call .cleanup_data when prepare_data fails	2025-04-25 10:43:25 +02:00
hsr
ieee802154
ife
ipv4	tcp: fix tcp_ofo_queue() to avoid including too much DUP SACK range	2025-08-15 12:04:57 +02:00
ipv6	ipv6: reject malicious packets in ipv6_gso_segment()	2025-08-15 12:05:10 +02:00
iucv
kcm
key
l2tp
l3mdev
lapb
llc	llc: fix data loss when reading from a socket in llc_ui_recvmsg()	2025-06-04 14:40:21 +02:00
mac80211	Reapply "wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()"	2025-08-15 12:04:59 +02:00
mac802154
mctp	net: mctp: Ensure keys maintain only one ref to corresponding dev	2025-05-22 14:10:02 +02:00
mpls	mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu().	2025-06-27 11:07:39 +01:00
mptcp	mptcp: sockopt: fix getting freebind & transparent	2025-04-25 10:44:00 +02:00
ncsi	net: ncsi: Fix GCPS 64-bit member variables	2025-06-27 11:07:09 +01:00
netfilter	netfilter: xt_nfacct: don't assume acct name is null-terminated	2025-08-15 12:05:00 +02:00
netlabel	calipso: unlock rcu before returning -EAFNOSUPPORT	2025-06-27 11:07:25 +01:00
netlink	netlink: make sure we allow at least one dump skb	2025-07-17 18:32:09 +02:00
netrom
nfc	NFC: nci: uart: Set tty->disc_data only in success path	2025-06-27 11:07:29 +01:00
nsh
openvswitch	net: openvswitch: Fix the dead loop of MPLS parse	2025-06-27 11:07:12 +01:00
packet	net/packet: fix a race in packet_set_ring() and packet_notifier()	2025-08-15 12:05:11 +02:00
phonet	phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept()	2025-07-24 08:51:48 +02:00
psample
qrtr
rds
rfkill
rose	rose: fix dangling neighbour pointers in rose_rt_device_down()	2025-07-10 15:59:48 +02:00
rxrpc	rxrpc: Fix oops due to non-existence of prealloc backlog struct	2025-07-17 18:32:06 +02:00
sched	net_sched: act_ctinfo: use atomic64_t for three counters	2025-08-15 12:04:58 +02:00
sctp	sctp: Do not wake readers in __sctp_write_space()	2025-06-27 11:07:33 +01:00
smc	net/smc: use the correct ndev to find pnetid by pnetid table	2025-06-04 14:40:06 +02:00
strparser	strparser: Add read_sock callback	2025-03-07 16:56:37 +01:00
sunrpc	SUNRPC: rpcbind should never reset the port to the value '0'	2025-06-04 14:40:03 +02:00
switchdev	net: switchdev: Convert blocking notification chain to a raw one	2025-03-28 21:58:49 +01:00
tipc	tipc: Fix use-after-free in tipc_conn_close().	2025-07-17 18:32:05 +02:00
tls	bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls	2025-08-15 12:04:56 +02:00
unix	af_unix: Don't set -ECONNRESET for consumed OOB skb.	2025-07-06 10:58:00 +02:00
vmw_vsock	vsock: Do not allow binding to VMADDR_PORT_ANY	2025-08-15 12:05:11 +02:00
wireless	wifi: prevent A-MSDU attacks in mesh networks	2025-07-17 18:32:08 +02:00
x25
xdp	xsk: fix an integer overflow in xp_create_and_assign_umem()	2025-03-28 21:59:01 +01:00
xfrm	xfrm: interface: fix use-after-free after changing collect_md xfrm interface	2025-08-15 12:04:46 +02:00
compat.c
devres.c
Kconfig
Kconfig.debug
Makefile	af_unix: Remove CONFIG_UNIX_SCM.	2025-06-04 14:40:23 +02:00
socket.c
sysctl_net.c