Go to file
Takamitsu Iwai 9c547c8eee net: rose: include node references in rose_neigh refcount
[ Upstream commit da9c9c8775 ]

Current implementation maintains two separate reference counting
mechanisms: the 'count' field in struct rose_neigh tracks references from
rose_node structures, while the 'use' field (now refcount_t) tracks
references from rose_sock.

This patch merges these two reference counting systems using 'use' field
for proper reference management. Specifically, this patch adds incrementing
and decrementing of rose_neigh->use when rose_neigh->count is incremented
or decremented.

This patch also modifies rose_rt_free(), rose_rt_device_down() and
rose_clear_route() to properly release references to rose_neigh objects
before freeing a rose_node through rose_remove_node().

These changes ensure rose_neigh structures are properly freed only when
all references, including those from rose_node structures, are released.
As a result, this resolves a slab-use-after-free issue reported by Syzbot.

Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Reported-by: syzbot+942297eecf7d2d61d1f1@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=942297eecf7d2d61d1f1
Signed-off-by: Takamitsu Iwai <takamitz@amazon.co.jp>
Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
Link: https://patch.msgid.link/20250823085857.47674-4-takamitz@amazon.co.jp
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2025-09-04 15:30:25 +02:00
arch powerpc/kvm: Fix ifdef to remove build warning 2025-09-04 15:30:20 +02:00
block block: reject invalid operation in submit_bio_noacct 2025-08-28 16:28:40 +02:00
certs
crypto crypto: jitter - fix intermediary handling 2025-08-28 16:28:26 +02:00
Documentation dt-bindings: display/msm: qcom,mdp5: drop lut clock 2025-09-04 15:30:22 +02:00
drivers net: stmmac: Set CIC bit only for TX queues with COE 2025-09-04 15:30:25 +02:00
fs NFS: Fix a race when updating an existing write 2025-09-04 15:30:20 +02:00
include net: rose: convert 'use' field to refcount_t 2025-09-04 15:30:25 +02:00
init
io_uring
ipc
kernel ftrace: Fix potential warning in trace_printk_seq during ftrace_dump 2025-09-04 15:30:19 +02:00
lib
LICENSES
mm mm/memory-failure: fix infinite UCE for VM_PFNMAP pfn 2025-08-28 16:28:43 +02:00
net net: rose: include node references in rose_neigh refcount 2025-09-04 15:30:25 +02:00
rust
samples
scripts kconfig: lxdialog: fix 'space' to (de)select options 2025-08-28 16:28:29 +02:00
security apparmor: use the condition in AA_BUG_FMT even with debug disabled 2025-08-28 16:28:28 +02:00
sound ASoC: codecs: tx-macro: correct tx_macro_component_drv name 2025-09-04 15:30:19 +02:00
tools bonding: Add independent control state machine 2025-08-28 16:28:49 +02:00
usr
virt
.clang-format
.cocciconfig
.get_maintainer.ignore
.gitattributes
.gitignore
.mailmap
.rustfmt.toml
COPYING
CREDITS
Kbuild
Kconfig
MAINTAINERS
Makefile Linux 6.6.103 2025-08-28 16:28:50 +02:00
README

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.