Jakub Kicinski e873e8f7d0 net/sched: act_mirred: don't override retval if we already lost the skb ... commit 166c2c8a6a upstream. If we're redirecting the skb, and haven't called tcf_mirred_forward(), yet, we need to tell the core to drop the skb by setting the retcode to SHOT. If we have called tcf_mirred_forward(), however, the skb is out of our hands and returning SHOT will lead to UaF. Move the retval override to the error path which actually need it. Reviewed-by: Michal Swiatkowski <michal.swiatkowski@linux.intel.com> Fixes: e5cf1baf92 ("act_mirred: use TC_ACT_REINSERT when possible") Signed-off-by: Jakub Kicinski <kuba@kernel.org> Acked-by: Jamal Hadi Salim <jhs@mojatatu.com> Signed-off-by: David S. Miller <davem@davemloft.net> [Minor conflict resolved due to code context change.] Signed-off-by: Jianqi Ren <jianqi.ren.cn@windriver.com> Signed-off-by: He Zhe <zhe.he@windriver.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2025-05-02 07:47:09 +02:00
..
6lowpan
9p	9p/net: fix improper handling of bogus negative read/write replies	2025-05-02 07:47:04 +02:00
802	net: 802: LLC+SNAP OID:PID lookup on start of skb data	2025-01-17 13:34:38 +01:00
8021q	net: vlan: don't propagate flags on open	2025-04-25 10:43:31 +02:00
appletalk	appletalk: Fix Use-After-Free in atalk_ioctl	2023-12-20 17:00:19 +01:00
atm	atm: Fix NULL pointer dereference	2025-04-07 10:05:45 +02:00
ax25	ax25: Fix refcount leak caused by setting SO_BINDTODEVICE sockopt	2025-02-21 13:49:56 +01:00
batman-adv	batman-adv: Ignore own maximum aggregation size during RX	2025-03-28 21:59:01 +01:00
bluetooth	Bluetooth: l2cap: Check encryption key size on incoming connection	2025-04-25 10:43:49 +02:00
bpf	bpf, test_run: Fix use-after-free issue in eth_skb_pkt_type()	2025-03-07 16:56:37 +01:00
bpfilter
bridge	net: bridge: switchdev: do not notify new brentries as changed	2025-04-25 10:43:50 +02:00
caif
can	can: statistics: use atomic access in hot path	2025-04-10 14:33:39 +02:00
ceph	libceph: fix race between delayed_work() and ceph_monc_stop()	2024-07-18 13:18:41 +02:00
core	net: selftests: initialize TCP header and skb payload with zero	2025-05-02 07:46:56 +02:00
dcb	net: dcb: choose correct policy to parse DCB_ATTR_BCN	2023-08-11 12:08:17 +02:00
dccp	net: fix data-races around sk->sk_forward_alloc	2025-01-23 17:17:17 +01:00
devlink	devlink: bump the instance index directly when iterating	2024-10-22 15:56:43 +02:00
dns_resolver	keys, dns: Fix size check of V1 server-list header	2024-01-25 15:27:38 -08:00
dsa	net: dsa: add support for mac_prepare() and mac_finish() calls	2025-05-02 07:46:50 +02:00
ethernet	ethernet: Add helper for assigning packet type when dest address does not match device address	2024-05-02 16:29:29 +02:00
ethtool	net: ethtool: Don't call .cleanup_data when prepare_data fails	2025-04-25 10:43:25 +02:00
hsr	net: hsr: fix fill_frame_info() regression vs VLAN packets	2025-02-21 13:49:23 +01:00
ieee802154	net: ieee802154: do not leave a dangling sk pointer in ieee802154_create()	2024-12-14 19:54:41 +01:00
ife	net: sched: ife: fix potential use-after-free	2024-01-01 12:38:56 +00:00
ipv4	net: fix geneve_opt length integer overflow	2025-04-10 14:33:41 +02:00
ipv6	ipv6: Align behavior across nexthops during path selection	2025-04-25 10:43:26 +02:00
iucv	s390/iucv: MSG_PEEK causes memory leak in iucv_sock_destruct()	2024-12-14 19:53:50 +01:00
kcm	kcm: Serialise kcm_sendmsg() for the same socket.	2024-08-29 17:30:44 +02:00
key	net: af_key: fix sadb_x_filter validation	2023-08-23 17:52:32 +02:00
l2tp	genetlink: hold RCU in genlmsg_mcast()	2024-11-01 01:56:00 +01:00
l3mdev
lapb
llc	llc: do not use skb_get() before dev_queue_xmit()	2025-03-13 12:53:17 +01:00
mac80211	wifi: mac80211: export ieee80211_purge_tx_queue() for drivers	2025-05-02 07:46:55 +02:00
mac802154	mac802154: check local interfaces before deleting sdata list	2025-01-23 17:17:11 +01:00
mctp	net: mctp: Set SOCK_RCU_FREE	2025-04-25 10:43:50 +02:00
mpls	net: mpls: error out if inner headers are not set	2024-04-13 13:05:27 +02:00
mptcp	mptcp: sockopt: fix getting freebind & transparent	2025-04-25 10:44:00 +02:00
ncsi	net/ncsi: use dev_set_mac_address() for Get MC MAC Address handling	2025-02-21 13:49:54 +01:00
netfilter	nft_set_pipapo: fix incorrect avx2 match of 5th field octet	2025-04-25 10:43:26 +02:00
netlabel	calipso: fix memory leak in netlbl_calipso_add_pass()	2024-01-25 15:27:20 -08:00
netlink	sock_diag: add module pointer to "struct sock_diag_handler"	2024-12-14 19:53:32 +01:00
netrom	netrom: check buffer length before accessing it	2025-01-09 13:30:01 +01:00
nfc	NFC: nci: Add bounds checking in nci_hci_create_pipe()	2025-02-21 13:49:51 +01:00
nsh	nsh: Restore skb->{protocol,data,mac_header} for outer header in nsh_gso_segment().	2024-05-17 11:55:59 +02:00
openvswitch	net: openvswitch: fix nested key length validation in the set() action	2025-04-25 10:43:50 +02:00
packet	af_packet: fix vlan_get_protocol_dgram() vs MSG_PEEK	2025-01-09 13:30:02 +01:00
phonet	phonet: fix rtm_phonet_notify() skb allocation	2024-05-17 11:56:12 +02:00
psample	psample: Require 'CAP_NET_ADMIN' when joining "packets" group	2023-12-13 18:39:11 +01:00
qrtr	net: qrtr: Update packets cloning when broadcasting	2024-10-17 15:21:13 +02:00
rds	net:rds: Fix possible deadlock in rds_message_put	2024-08-29 17:30:20 +02:00
rfkill	net: rfkill: gpio: Add check for clk_enable()	2024-12-14 19:53:33 +01:00
rose	net: rose: lock the socket in rose_bind()	2025-02-21 13:49:37 +01:00
rxrpc	rxrpc: Improve setsockopt() handling of malformed user input	2024-12-14 19:53:52 +01:00
sched	net/sched: act_mirred: don't override retval if we already lost the skb	2025-05-02 07:47:09 +02:00
sctp	sctp: detect and prevent references to a freed transport in sendmsg	2025-04-25 10:43:43 +02:00
smc	net/smc: fix data error when recvmsg with MSG_PEEK flag	2025-02-21 13:49:03 +01:00
strparser	strparser: Add read_sock callback	2025-03-07 16:56:37 +01:00
sunrpc	sunrpc: suppress warnings for unused procfs functions	2025-03-07 16:56:42 +01:00
switchdev	net: switchdev: Convert blocking notification chain to a raw one	2025-03-28 21:58:49 +01:00
tipc	tipc: fix NULL pointer dereference in tipc_mon_reinit_self()	2025-05-02 07:46:55 +02:00
tls	net: tls: explicitly disallow disconnect	2025-04-25 10:43:25 +02:00
unix	sock_diag: add module pointer to "struct sock_diag_handler"	2024-12-14 19:53:32 +01:00
vmw_vsock	vsock: avoid timeout during connect() if the socket is closing	2025-04-10 14:33:40 +02:00
wireless	wifi: cfg80211: cancel wiphy_work before freeing wiphy	2025-03-28 21:58:48 +01:00
x25	net/x25: fix incorrect parameter validation in the x25_getsockopt() function	2024-03-26 18:20:42 -04:00
xdp	xsk: fix an integer overflow in xp_create_and_assign_umem()	2025-03-28 21:59:01 +01:00
xfrm	xfrm_output: Force software GSO only in tunnel mode	2025-03-28 21:58:59 +01:00
compat.c
devres.c
Kconfig
Kconfig.debug
Makefile	devlink: move code to a dedicated directory	2023-08-30 16:11:00 +02:00
socket.c	net: explicitly clear the sk pointer, when pf->create fails	2024-10-17 15:22:27 +02:00
sysctl_net.c	sysctl: treewide: drop unused argument ctl_table_root::set_ownership(table)	2024-08-11 12:35:51 +02:00