Takamitsu Iwai 0085b250fc net: rose: convert 'use' field to refcount_t ... [ Upstream commit d860d1faa6b2ce3becfdb8b0c2b048ad31800061 ] The 'use' field in struct rose_neigh is used as a reference counter but lacks atomicity. This can lead to race conditions where a rose_neigh structure is freed while still being referenced by other code paths. For example, when rose_neigh->use becomes zero during an ioctl operation via rose_rt_ioctl(), the structure may be removed while its timer is still active, potentially causing use-after-free issues. This patch changes the type of 'use' from unsigned short to refcount_t and updates all code paths to use rose_neigh_hold() and rose_neigh_put() which operate reference counts atomically. Fixes: 1da177e4c3 ("Linux-2.6.12-rc2") Signed-off-by: Takamitsu Iwai <takamitz@amazon.co.jp> Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com> Link: https://patch.msgid.link/20250823085857.47674-3-takamitz@amazon.co.jp Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>		2025-09-04 15:31:51 +02:00
..
9p	netfs, 9p: Implement helpers for new write code	2024-05-01 18:07:37 +01:00
bluetooth	Bluetooth: hci_sync: fix set_local_name race condition	2025-09-04 15:31:47 +02:00
caif	net: Correct spelling in headers	2024-08-26 09:37:23 -07:00
iucv	s390/iucv: Correct spelling in iucv.h	2024-08-26 09:37:22 -07:00
libeth	libeth: add Tx buffer completion helpers	2024-09-09 13:15:37 -07:00
mana	net: mana: Support holes in device list reply msg	2025-03-28 22:03:28 +01:00
netfilter	netfilter: nf_conntrack: fix crash due to removal of uninitialised entry	2025-07-24 08:56:33 +02:00
netns	xfrm: Add an inbound percpu state cache.	2025-02-08 09:58:00 +01:00
nfc	NFC: Correct spelling in headers	2024-08-26 09:37:23 -07:00
page_pool	page_pool: Track DMA-mapped pages and unmap them when destroying the pool	2025-06-19 15:31:42 +02:00
phonet
sctp	sctp: detect and prevent references to a freed transport in sendmsg	2025-04-20 10:15:50 +02:00
tc_act	net_sched: act_ctinfo: use atomic64_t for three counters	2025-08-15 12:13:43 +02:00
6lowpan.h
act_api.h	net/sched: Add helper macros with module names	2024-02-02 10:57:55 -08:00
addrconf.h	net: Correct spelling in headers	2024-08-26 09:37:23 -07:00
af_ieee802154.h
af_rxrpc.h
af_unix.h	af_unix: Remove U_LOCK_GC_LISTENER.	2024-06-25 11:10:18 +02:00
af_vsock.h	vsock: fix vsock_proto declaration	2025-07-17 18:37:05 +02:00
ah.h
amt.h
arp.h
atmclip.h
ax25.h	ax25: rcu protect dev->ax25_ptr	2025-02-08 09:57:10 +01:00
ax88796.h
bareudp.h
bond_3ad.h	bonding: update LACP activity flag after setting lacp_active	2025-08-28 16:31:15 +02:00
bond_alb.h	bonding: Correct spelling in headers	2024-08-26 09:37:22 -07:00
bond_options.h	bonding: add ns target multicast address to slave device	2024-11-14 11:16:28 +01:00
bonding.h	bonding: change ipsec_lock from spin lock to mutex	2024-08-27 13:11:37 -07:00
bpf_sk_storage.h
busy_poll.h	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2024-08-29 11:49:10 -07:00
calipso.h	move asm/unaligned.h to linux/unaligned.h	2024-10-02 17:23:23 -04:00
cfg80211-wext.h
cfg80211.h	wifi: cfg80211: Fix interface type validation	2025-08-20 18:30:31 +02:00
cfg802154.h	mac802154: fix llsec key resources release in mac802154_llsec_key_del	2024-03-06 21:01:26 +01:00
checksum.h	net: Fix checksum update for ILA adj-transport	2025-06-27 11:11:40 +01:00
cipso_ipv4.h	move asm/unaligned.h to linux/unaligned.h	2024-10-02 17:23:23 -04:00
cls_cgroup.h
codel_impl.h
codel_qdisc.h
codel.h
compat.h
datalink.h
dcbevent.h
dcbnl.h
devlink.h	devlink: Constify the 'table_ops' parameter of devl_dpipe_table_register()	2024-06-05 10:24:57 +01:00
dropreason-core.h	net: Correct spelling in headers	2024-08-26 09:37:23 -07:00
dropreason.h
dsa_stubs.h
dsa.h	net: dsa: provide a software untagging function on RX for VLAN-aware bridges	2024-08-16 09:59:32 +01:00
dscp.h	net: add IEEE 802.1q specific helpers	2024-05-08 10:35:09 +01:00
dsfield.h
dst_cache.h	net: Correct spelling in headers	2024-08-26 09:37:23 -07:00
dst_metadata.h	net: Silence false field-spanning write warning in metadata_dst memcpy	2024-08-20 15:22:17 -07:00
dst_ops.h	net: fix __dst_negative_advice() race	2024-05-29 17:34:49 -07:00
dst.h	net: dst: annotate data-races around dst->output	2025-08-15 12:13:41 +02:00
eee.h	net: add helpers for EEE configuration	2024-03-05 19:21:17 -08:00
erspan.h	net: Correct spelling in headers	2024-08-26 09:37:23 -07:00
esp.h
espintcp.h	inet: preserve const qualifier in inet_csk()	2024-04-01 21:27:08 -07:00
ethoc.h
failover.h
fib_notifier.h
fib_rules.h
firewire.h
flow_dissector.h	flow_dissector: cleanup FLOW_DISSECTOR_KEY_ENC_FLAGS	2024-07-15 09:14:39 -07:00
flow_offload.h	flow_offload: add encapsulation control flag helpers	2024-06-12 17:56:00 -07:00
flow.h
fou.h
fq_impl.h
fq.h
garp.h
gen_stats.h
genetlink.h	genetlink: hold RCU in genlmsg_mcast()	2024-10-15 17:52:58 -07:00
geneve.h
gre.h	ip_tunnel: convert __be16 tunnel flags to bitmaps	2024-04-01 10:49:28 +01:00
gro_cells.h
gro.h	net: allow small head cache usage with large MAX_SKB_FRAGS values	2025-02-27 04:30:18 -08:00
gso.h
gtp.h	gtp: properly parse extension headers	2024-05-07 01:35:55 +02:00
gue.h
handshake.h
hotdata.h	net: move sysctl_mem_pcpu_rsv to net_hotdata	2024-04-30 18:46:52 -07:00
hwbm.h	net: Correct spelling in headers	2024-08-26 09:37:23 -07:00
icmp.h
ieee8021q.h	net: add IEEE 802.1q specific helpers	2024-05-08 10:35:09 +01:00
ieee80211_radiotap.h	wireless fixes for v6.12-rc5	2024-10-25 10:44:41 +01:00
ieee802154_netdev.h
if_inet6.h	ipv6: anycast: complete RCU handling of struct ifacaddr6	2024-02-26 18:40:34 -08:00
ife.h
inet_common.h	net: change proto and proto_ops accept type	2024-05-13 18:19:09 -06:00
inet_connection_sock.h	tcp/dccp: allow a connection when sk_max_ack_backlog is zero	2025-01-17 13:40:37 +01:00
inet_dscp.h
inet_ecn.h
inet_frag.h	net: Rename mono_delivery_time to tstamp_type for scalabilty	2024-05-23 14:14:23 -07:00
inet_hashtables.h	inet: constify 'struct net' parameter of various lookup helpers	2024-08-05 16:22:45 -07:00
inet_sock.h	inet: constify inet_sk_bound_dev_eq() net parameter	2024-08-05 16:22:45 -07:00
inet_timewait_sock.h	tcp: remove volatile qualifier on tw_substate	2024-08-28 17:08:16 -07:00
inet6_connection_sock.h
inet6_hashtables.h	inet6: constify 'struct net' parameter of various lookup helpers	2024-08-05 16:27:26 -07:00
inetpeer.h	inetpeer: remove create argument of inet_getpeer()	2025-02-08 09:57:06 +01:00
ioam6.h	net: ioam6: multicast event	2024-02-28 11:19:41 +00:00
ip_fib.h	ipv4: Fix user space build failure due to header change	2024-09-04 16:40:33 -07:00
ip_tunnels.h	ipv4: ip_tunnel: Fix suspicious RCU usage warning in ip_tunnel_init_flow()	2024-10-29 11:12:25 -07:00
ip_vs.h
ip.h	ipv4: Convert ip_route_input() to dscp_t.	2025-03-07 18:25:29 +01:00
ip6_checksum.h
ip6_fib.h	ipv6: introduce dst_rt6_info() helper	2024-04-29 13:32:01 +01:00
ip6_route.h	ipv6: fix source address selection with route leak	2024-07-14 07:34:16 -07:00
ip6_tunnel.h	ip_tunnel: convert __be16 tunnel flags to bitmaps	2024-04-01 10:49:28 +01:00
ipcomp.h
ipconfig.h
ipv6_frag.h
ipv6_stubs.h	ipv6: udp: constify 'struct net' parameter of socket lookups	2024-08-05 16:27:26 -07:00
ipv6.h	ipv6: replace ipcm6_init calls with ipcm6_init_sk	2025-06-27 11:11:41 +01:00
iw_handler.h	wifi: cfg80211: wext: Update spelling and grammar	2024-09-03 11:49:27 +02:00
kcm.h	net: kcm: Fix race condition in kcm_unattach()	2025-08-20 18:30:18 +02:00
l3mdev.h	vrf: use RCU protection in l3mdev_l3_out()	2025-02-21 14:01:16 +01:00
lag.h
lapb.h	net: lapb: increase LAPB_HEADER_LEN	2024-12-19 18:13:13 +01:00
lib80211.h	wifi: lib80211: Handle const struct lib80211_crypto_ops in lib80211	2024-08-27 10:28:49 +02:00
llc_c_ac.h
llc_c_ev.h
llc_c_st.h	llc: Constify struct llc_conn_state_trans	2024-07-15 08:51:01 -07:00
llc_conn.h
llc_if.h
llc_pdu.h	net: Correct spelling in headers	2024-08-26 09:37:23 -07:00
llc_s_ac.h
llc_s_ev.h
llc_s_st.h	llc: Constify struct llc_sap_state_trans	2024-07-15 08:51:19 -07:00
llc_sap.h
llc.h
lwtunnel.h	net: dst: annotate data-races around dst->output	2025-08-15 12:13:41 +02:00
mac80211.h	wifi: mac80211: avoid weird state in error path	2025-08-20 18:30:32 +02:00
mac802154.h	move asm/unaligned.h to linux/unaligned.h	2024-10-02 17:23:23 -04:00
macsec.h	macsec: Enable devices to advertise whether they update sk_buff md_dst during offloads	2024-04-25 08:20:54 -07:00
mctp.h	mctp: Handle error of rtnl_register_module().	2024-10-10 15:39:35 +02:00
mctpdevice.h
mip6.h
mld.h
mpls_iptunnel.h
mpls.h
mptcp.h	mptcp: fallback to TCP after SYN+MPC drops	2024-09-11 15:57:50 -07:00
mrp.h
ncsi.h
ndisc.h	ipv6: eliminate ndisc_ops_is_useropt()	2024-08-12 17:23:57 -07:00
neighbour.h	neighbour: add support for NUD_PERMANENT proxy entries	2025-08-20 18:30:37 +02:00
net_debug.h	Rename .data.once to .data..once to fix resetting WARN*_ONCE	2024-12-05 14:03:08 +01:00
net_failover.h
net_namespace.h	net: Add net_passive_inc() and net_passive_dec().	2025-08-20 18:30:56 +02:00
net_ratelimit.h
net_trackers.h
netdev_queues.h	net: export a helper for adding up queue stats	2025-05-18 08:24:50 +02:00
netdev_rx_queue.h	memory-provider: fix compilation issue without SYSFS	2024-09-12 21:00:26 -07:00
netevent.h
netkit.h
netlabel.h	netlabel: Correct spelling in netlabel.h	2024-08-26 09:37:22 -07:00
netlink.h	net: Correct spelling in headers	2024-08-26 09:37:23 -07:00
netmem.h	page_pool: devmem support	2024-09-11 20:44:31 -07:00
netprio_cgroup.h
netrom.h
nexthop.h	net: nexthop: Increase weight to u16	2024-08-12 17:50:34 -07:00
nl802154.h	ieee802154: Correct spelling in nl802154.h	2024-08-30 22:30:55 +02:00
nsh.h
p8022.h
pfcp.h	pfcp: always set pfcp metadata	2024-04-01 10:49:28 +01:00
pie.h
ping.h
pkt_cls.h	net: sched: refine software bypass handling in tc_run	2025-02-08 09:57:25 +01:00
pkt_sched.h	net/sched: Add helper macros with module names	2024-02-02 10:57:55 -08:00
pptp.h
proto_memory.h	net: move sysctl_mem_pcpu_rsv to net_hotdata	2024-04-30 18:46:52 -07:00
protocol.h	ipv6: move tcp_ipv6_hash_secret and udp_ipv6_hash_secret to net_hotdata	2024-03-07 21:12:43 -08:00
psample.h	net: psample: fix flag being set in wrong skb	2024-07-11 18:11:31 -07:00
psnap.h
raw.h
rawv6.h
red.h	net: sched: Correct spelling in headers	2024-08-26 09:37:23 -07:00
regulatory.h	net: Correct spelling in headers	2024-08-26 09:37:23 -07:00
request_sock.h	tcp: move reqsk_alloc() to inet_connection_sock.c	2024-06-06 15:18:04 +02:00
rose.h	net: rose: convert 'use' field to refcount_t	2025-09-04 15:31:51 +02:00
route.h	ipv4: Convert ip_route_input() to dscp_t.	2025-03-07 18:25:29 +01:00
rpl.h
rps.h	net: rps: add rps_input_queue_head_add() helper	2024-04-01 11:28:32 +01:00
rsi_91x.h
rstreason.h	tcp: rstreason: introduce SK_RST_REASON_TCP_DISCONNECT_WITH_DATA for active reset	2024-08-07 10:24:46 +01:00
rtnetlink.h	rtnetlink: Add bulk registration helpers for rtnetlink message handlers.	2024-10-10 15:39:35 +02:00
rtnh.h
sch_generic.h	net_sched: Flush gso_skb list too during ->change()	2025-05-22 14:29:39 +02:00
scm.h	af_unix: Add dead flag to struct scm_fp_list.	2024-05-10 18:52:45 -07:00
secure_seq.h
seg6_hmac.h	ipv6: sr: restruct ifdefines	2024-05-30 18:29:38 -07:00
seg6_local.h	seg6: Use nested-BH locking for seg6_bpf_srh_states.	2024-06-24 16:41:23 -07:00
seg6.h	ipv6: sr: restruct ifdefines	2024-05-30 18:29:38 -07:00
selftests.h
slhc_vj.h
smc.h	net/smc: add operations to merge sndbuf with peer DMB	2024-04-30 13:24:48 +02:00
snmp.h
sock_reuseport.h	net: core: annotate socks of struct sock_reuseport with __counted_by	2024-08-02 17:16:59 -07:00
sock.h	net: better track kernel sockets lifetime	2025-08-20 18:30:56 +02:00
Space.h
stp.h
strparser.h	strparser: Add read_sock callback	2025-02-27 04:30:19 -08:00
switchdev.h	net: bridge: switchdev: Skip MDB replays of deferred events on offload	2024-02-16 09:36:37 +00:00
tc_wrapper.h	Merge branch 'x86/bugs' into x86/core, to pick up pending changes before dependent patches	2024-02-14 10:49:37 +01:00
tcp_ao.h	net/tcp: Add missing lockdep annotations for TCP-AO hlist traversals	2024-12-14 20:03:53 +01:00
tcp_states.h
tcp.h	bpf: Fix wrong copied_seq calculation	2025-02-27 04:30:19 -08:00
tcx.h	bpf: Fix too early release of tcx_entry	2024-07-08 14:07:31 -07:00
timewait_sock.h	tcp: get rid of twsk_unique()	2024-05-09 20:25:55 -07:00
tipc.h
tls_prot.h
tls_toe.h
tls.h	bpf: Add sk_is_inet and IS_ICSK check in tls_sw_has_ctx_tx/rx	2024-11-06 11:08:56 -08:00
transp_v6.h
tso.h
tun_proto.h
udp_tunnel.h	ip_tunnel: convert __be16 tunnel flags to bitmaps	2024-04-01 10:49:28 +01:00
udp.h	net: drop UFO packets in udp_rcv_segment()	2025-08-15 12:14:06 +02:00
udplite.h
vsock_addr.h
vxlan.h
wext.h
x25.h	x25: Correct spelling in x25.h	2024-08-26 09:37:23 -07:00
x25device.h
xdp_priv.h
xdp_sock_drv.h	xsk: use generic DMA sync shortcut instead of a custom one	2024-05-08 08:51:20 +02:00
xdp_sock.h	xsk: Fix race condition in AF_XDP generic RX path	2025-05-09 09:50:38 +02:00
xdp.h
xfrm.h	espintcp: remove encap socket caching to avoid reference leak	2025-05-29 11:03:14 +02:00
xsk_buff_pool.h	xsk: Fix race condition in AF_XDP generic RX path	2025-05-09 09:50:38 +02:00