Eric Dumazet 1d9c73561c net: rose: fix a typo in rose_clear_routes() ... commit 1cc8a5b534e5f9b5e129e54ee2e63c9f5da4f39a upstream. syzbot crashed in rose_clear_routes(), after a recent patch typo. KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] CPU: 0 UID: 0 PID: 10591 Comm: syz.3.1856 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 RIP: 0010:rose_clear_routes net/rose/rose_route.c:565 [inline] RIP: 0010:rose_rt_ioctl+0x162/0x1250 net/rose/rose_route.c:760 <TASK> rose_ioctl+0x3ce/0x8b0 net/rose/af_rose.c:1381 sock_do_ioctl+0xd9/0x300 net/socket.c:1238 sock_ioctl+0x576/0x790 net/socket.c:1359 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:598 [inline] __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:584 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f Fixes: da9c9c877597 ("net: rose: include node references in rose_neigh refcount") Reported-by: syzbot+2eb8d1719f7cfcfa6840@syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/68af3e29.a70a0220.3cafd4.002e.GAE@google.com/T/#u Signed-off-by: Eric Dumazet <edumazet@google.com> Cc: Takamitsu Iwai <takamitz@amazon.co.jp> Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com> Link: https://patch.msgid.link/20250827172149.5359-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2025-09-04 15:31:55 +02:00
..
6lowpan
9p	9p/trans_fd: mark concurrent read and writes to p9_conn->err	2025-05-02 07:59:20 +02:00
802	net: 802: LLC+SNAP OID:PID lookup on start of skb data	2025-01-17 13:40:37 +01:00
8021q	net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime	2025-07-24 08:56:34 +02:00
appletalk	net: appletalk: Fix use-after-free in AARP proxy probe	2025-08-01 09:48:41 +01:00
atm	atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control().	2025-09-04 15:31:47 +02:00
ax25	ax25: Fix refcount leak caused by setting SO_BINDTODEVICE sockopt	2025-02-21 14:01:16 +01:00
batman-adv	batman-adv: Ignore own maximum aggregation size during RX	2025-03-28 22:03:31 +01:00
bluetooth	Bluetooth: hci_sync: fix set_local_name race condition	2025-09-04 15:31:47 +02:00
bpf	bpf, test_run: Fix use-after-free issue in eth_skb_pkt_type()	2025-02-27 04:30:18 -08:00
bridge	net: bridge: fix soft lockup in br_multicast_query_expired()	2025-08-28 16:31:12 +02:00
caif	caif: reduce stack size, again	2025-08-15 12:13:40 +02:00
can	can: bcm: add missing rcu read protection for procfs content	2025-05-29 11:03:19 +02:00
ceph	ceph: allocate sparse_ext map only for sparse reads	2025-01-02 10:34:09 +01:00
core	net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM	2025-08-28 16:31:14 +02:00
dcb
dccp	dccp: Fix memory leak in dccp_feat_change_recv	2024-12-14 20:03:05 +01:00
devlink	devlink: fix xa_alloc_cyclic() error handling	2025-03-28 22:03:27 +01:00
dns_resolver
dsa	net: dsa: tag_brcm: legacy: fix pskb_may_pull length	2025-06-19 15:32:16 +02:00
ethernet
ethtool	ethtool: cmis_cdb: use correct rpl size in ethtool_cmis_module_poll()	2025-04-25 10:47:43 +02:00
handshake
hsr	net, hsr: reject HSR frame if skb can't hold tag	2025-08-28 16:31:02 +02:00
ieee802154	net: ieee802154: do not leave a dangling sk pointer in ieee802154_create()	2024-12-14 20:03:47 +01:00
ife
ipv4	net: ipv4: fix regression in local-broadcast routes	2025-09-04 15:31:45 +02:00
ipv6	netfilter: nf_reject: don't leak dst refcount for loopback packets	2025-08-28 16:31:16 +02:00
iucv	s390/iucv: MSG_PEEK causes memory leak in iucv_sock_destruct()	2024-12-05 14:02:31 +01:00
kcm	net: kcm: Fix race condition in kcm_unattach()	2025-08-20 18:30:18 +02:00
key	xfrm: Add support for per cpu xfrm state handling.	2025-02-08 09:58:00 +01:00
l2tp	l2tp: do not use sock_hold() in pppol2tp_session_get_sock()	2025-09-04 15:31:51 +02:00
l3mdev
lapb
llc	llc: fix data loss when reading from a socket in llc_ui_recvmsg()	2025-05-29 11:03:20 +02:00
mac80211	wifi: mac80211: check basic rates validity in sta_link_apply_parameters	2025-08-20 18:30:56 +02:00
mac802154	mac802154: check local interfaces before deleting sdata list	2025-01-23 17:22:54 +01:00
mctp	net: mctp: Prevent duplicate binds	2025-08-20 18:30:31 +02:00
mpls	mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu().	2025-06-27 11:11:43 +01:00
mptcp	mptcp: disable add_addr retransmission when timeout is 0	2025-08-28 16:31:07 +02:00
ncsi	net: ncsi: Fix buffer overflow in fetching version id	2025-08-20 18:30:38 +02:00
netfilter	netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps	2025-08-20 18:30:28 +02:00
netlabel	calipso: unlock rcu before returning -EAFNOSUPPORT	2025-06-19 15:32:37 +02:00
netlink	net: better track kernel sockets lifetime	2025-08-20 18:30:56 +02:00
netrom	netrom: check buffer length before accessing it	2025-01-09 13:33:38 +01:00
nfc	NFC: nci: uart: Set tty->disc_data only in success path	2025-06-27 11:11:21 +01:00
nsh
openvswitch	net: openvswitch: Fix the dead loop of MPLS parse	2025-06-19 15:31:55 +02:00
packet	net/packet: fix a race in packet_set_ring() and packet_notifier()	2025-08-15 12:14:09 +02:00
phonet	phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept()	2025-07-24 08:56:24 +02:00
psample	psample: adjust size if rate_as_probability is set	2024-12-27 14:02:06 +01:00
qrtr	net: qrtr: Update packets cloning when broadcasting	2024-09-24 10:48:16 +02:00
rds	net: better track kernel sockets lifetime	2025-08-20 18:30:56 +02:00
rfkill	net: rfkill: gpio: Add check for clk_enable()	2024-12-05 14:01:57 +01:00
rose	net: rose: fix a typo in rose_clear_routes()	2025-09-04 15:31:55 +02:00
rxrpc	rxrpc: Fix transmission of an abort in response to an abort	2025-07-24 08:56:35 +02:00
sched	net/sched: Remove unnecessary WARNING condition for empty child qdisc in htb_activate	2025-08-28 16:31:15 +02:00
sctp	sctp: initialize more fields in sctp_v6_from_sk()	2025-09-04 15:31:51 +02:00
smc	net/smc: fix UAF on smcsk after smc_listen_out()	2025-08-28 16:31:14 +02:00
strparser	strparser: Add read_sock callback	2025-02-27 04:30:19 -08:00
sunrpc	net: better track kernel sockets lifetime	2025-08-20 18:30:56 +02:00
switchdev	net: switchdev: Convert blocking notification chain to a raw one	2025-03-22 12:54:12 -07:00
tipc	tipc: Fix use-after-free in tipc_conn_close().	2025-07-17 18:37:05 +02:00
tls	tls: fix handling of zero-length records on the rx_list	2025-08-28 16:31:11 +02:00
unix	af_unix: Don't set -ECONNRESET for consumed OOB skb.	2025-07-06 11:01:40 +02:00
vmw_vsock	vsock/virtio: Validate length in packet header before skb_put()	2025-08-28 16:30:59 +02:00
wireless	wifi: cfg80211: reject HTC bit for management frames	2025-08-20 18:30:29 +02:00
x25
xdp	xsk: Fix race condition in AF_XDP generic RX path	2025-05-09 09:50:38 +02:00
xfrm	xfrm: Duplicate SPI Handling	2025-08-20 18:30:34 +02:00
compat.c
devres.c
Kconfig	memory-provider: disable building dmabuf mp on !CONFIG_PAGE_POOL	2024-09-13 11:41:45 -07:00
Kconfig.debug
Makefile
socket.c	net: explicitly clear the sk pointer, when pf->create fails	2024-10-07 16:21:59 -07:00
sysctl_net.c