Ilya Lesokhin d91c3e17f7 net/tls: Only attach to sockets in ESTABLISHED state ... Calling accept on a TCP socket with a TLS ulp attached results in two sockets that share the same ulp context. The ulp context is freed while a socket is destroyed, so after one of the sockets is released, the second second will trigger a use after free when it tries to access the ulp context attached to it. We restrict the TLS ulp to sockets in ESTABLISHED state to prevent the scenario above. Fixes: 3c4d755915 ("tls: kernel TLS support") Reported-by: syzbot+904e7cd6c5c741609228@syzkaller.appspotmail.com Signed-off-by: Ilya Lesokhin <ilyal@mellanox.com> Signed-off-by: David S. Miller <davem@davemloft.net>		2018-01-17 16:05:28 -05:00
..
6lowpan	…
9p	9p: add missing module license for xen transport	2018-01-15 13:13:53 -05:00
802	treewide: setup_timer() -> timer_setup()	2017-11-21 15:57:07 -08:00
8021q	8021q: fix a memory leak for VLAN 0 device	2018-01-10 15:31:07 -05:00
appletalk	treewide: setup_timer() -> timer_setup()	2017-11-21 15:57:07 -08:00
atm	treewide: Remove TIMER_FUNC_TYPE and TIMER_DATA_TYPE casts	2017-11-21 16:35:54 -08:00
ax25	…
batman-adv	batman-adv: Fix lock for ogm cnt access in batadv_iv_ogm_calc_tq	2017-12-04 11:47:33 +01:00
bluetooth	Bluetooth: Prevent stack info leak from the EFS element.	2018-01-04 17:01:01 +01:00
bpf	…
bridge	net: bridge: fix early call to br_stp_change_bridge_id and plug newlink leaks	2017-12-18 13:29:01 -05:00
caif	caif_usb: use strlcpy() instead of strncpy()	2018-01-10 15:06:14 -05:00
can	treewide: Remove TIMER_FUNC_TYPE and TIMER_DATA_TYPE casts	2017-11-21 16:35:54 -08:00
ceph	We have a set of file locking improvements from Zheng, rbd rw/ro	2017-11-21 05:38:32 -10:00
core	net: Allow neigh contructor functions ability to modify the primary_key	2018-01-15 14:53:43 -05:00
dcb	…
dccp	dccp: CVE-2017-8824: use-after-free in DCCP code	2017-12-05 18:08:53 -05:00
decnet	treewide: setup_timer() -> timer_setup()	2017-11-21 15:57:07 -08:00
dns_resolver	…
dsa	net: remove duplicate includes	2017-12-13 13:18:46 -05:00
ethernet	…
hsr	…
ieee802154	…
ife	…
ipv4	ipv4: Make neigh lookup keys for loopback/point-to-point devices be INADDR_ANY	2018-01-15 14:53:43 -05:00
ipv6	ipv6: ip6_make_skb() needs to clear cork.base.dst	2018-01-15 14:19:32 -05:00
ipx	…
iucv	…
kcm	make sock_alloc_file() do sock_release() on failures	2017-12-05 18:39:29 -05:00
key	af_key: Fix memory leak in key_notify_policy.	2018-01-10 09:45:11 +01:00
l2tp	…
l3mdev	…
lapb	treewide: Remove TIMER_FUNC_TYPE and TIMER_DATA_TYPE casts	2017-11-21 16:35:54 -08:00
llc	…
mac80211	mac80211: mesh: drop frames appearing to be from us	2018-01-04 15:51:53 +01:00
mac802154	…
mpls	…
ncsi	treewide: setup_timer() -> timer_setup() (2 field)	2017-11-21 15:57:09 -08:00
netfilter	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2018-01-08 20:21:39 -08:00
netlabel	net/netlabel: Add list_next_rcu() in rcu_dereference().	2017-11-18 10:32:41 +09:00
netlink	netlink: extack needs to be reset each time through loop	2018-01-15 13:50:07 -05:00
netrom	treewide: Remove TIMER_FUNC_TYPE and TIMER_DATA_TYPE casts	2017-11-21 16:35:54 -08:00
nfc	treewide: setup_timer() -> timer_setup()	2017-11-21 15:57:07 -08:00
nsh	…
openvswitch	Revert "openvswitch: Add erspan tunnel support."	2018-01-15 14:33:16 -05:00
packet	net/packet: fix a race in packet_bind() and packet_notifier()	2017-11-28 11:13:30 -05:00
phonet	…
psample	…
qrtr	…
rds	RDS: null pointer dereference in rds_atomic_free_op	2018-01-04 14:19:26 -05:00
rfkill	…
rose	treewide: Remove TIMER_FUNC_TYPE and TIMER_DATA_TYPE casts	2017-11-21 16:35:54 -08:00
rxrpc	rxrpc: Use correct netns source in rxrpc_release_sock()	2017-12-03 10:05:20 -05:00
sched	net, sched: fix panic when updating miniq {b,q}stats	2018-01-16 15:02:36 -05:00
sctp	sctp: do not allow the v4 socket to bind a v4mapped v6 address	2018-01-16 14:24:20 -05:00
smc	net/smc: Fix preinitialization of buf_desc in __smc_buf_create()	2017-11-24 01:33:34 +09:00
strparser	strparser: Call sock_owned_by_user_nocheck	2017-12-28 14:28:22 -05:00
sunrpc	NFS client fixes for Linux 4.15-rc4	2017-12-16 13:12:53 -08:00
switchdev	…
tipc	tipc: fix a memory leak in tipc_nl_node_get_link()	2018-01-15 13:45:50 -05:00
tls	net/tls: Only attach to sockets in ESTABLISHED state	2018-01-17 16:05:28 -05:00
unix	…
vmw_vsock	VSOCK: fix outdated sk_state value in hvs_release()	2017-12-05 15:07:37 -05:00
wimax	…
wireless	cfg80211: check dev_set_name() return value	2018-01-15 11:35:06 +01:00
x25	treewide: Remove TIMER_FUNC_TYPE and TIMER_DATA_TYPE casts	2017-11-21 16:35:54 -08:00
xfrm	xfrm: Fix a race in the xdst pcpu cache.	2018-01-10 12:14:28 +01:00
Kconfig	…
Makefile	…
compat.c	…
socket.c	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2018-01-10 17:55:42 -08:00
sysctl_net.c	…