Budimir Markovic 44bd006d5c vsock: Do not allow binding to VMADDR_PORT_ANY ... commit aba0c94f61 upstream. It is possible for a vsock to autobind to VMADDR_PORT_ANY. This can cause a use-after-free when a connection is made to the bound socket. The socket returned by accept() also has port VMADDR_PORT_ANY but is not on the list of unbound sockets. Binding it will result in an extra refcount decrement similar to the one fixed in fcdd2242c0 (vsock: Keep the binding until socket destruction). Modify the check in __vsock_bind_connectible() to also prevent binding to VMADDR_PORT_ANY. Fixes: d021c34405 ("VSOCK: Introduce VM Sockets") Reported-by: Budimir Markovic <markovicbudimir@gmail.com> Signed-off-by: Budimir Markovic <markovicbudimir@gmail.com> Reviewed-by: Stefano Garzarella <sgarzare@redhat.com> Link: https://patch.msgid.link/20250807041811.678-1-markovicbudimir@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2025-08-15 12:09:05 +02:00
..
6lowpan
9p	9p/net: fix improper handling of bogus negative read/write replies	2025-05-02 07:50:56 +02:00
802
8021q	net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime	2025-07-24 08:53:19 +02:00
appletalk	net: appletalk: Fix use-after-free in AARP proxy probe	2025-08-01 09:47:29 +01:00
atm	atm: clip: Fix NULL pointer dereference in vcc_sendmsg()	2025-07-17 18:35:11 +02:00
ax25
batman-adv
bluetooth	Bluetooth: hci_event: Mask data status from LE ext adv reports	2025-08-15 12:08:49 +02:00
bpf
bpfilter
bridge	net: bridge: Do not offload IGMP/MLD messages	2025-07-24 08:53:19 +02:00
caif	caif: reduce stack size, again	2025-08-15 12:08:45 +02:00
can	can: bcm: add missing rcu read protection for procfs content	2025-06-04 14:42:19 +02:00
ceph
core	netpoll: prevent hanging NAPI when netcons gets enabled	2025-08-15 12:09:02 +02:00
dcb
dccp
devlink
dns_resolver
dsa	net: dsa: tag_brcm: legacy: fix pskb_may_pull length	2025-06-19 15:28:33 +02:00
ethernet
ethtool
handshake
hsr
ieee802154	net: Rename mono_delivery_time to tstamp_type for scalabilty	2025-05-09 09:43:57 +02:00
ife
ipv4	tcp: call tcp_measure_rcv_mss() for ooo packets	2025-08-15 12:08:47 +02:00
ipv6	ipv6: reject malicious packets in ipv6_gso_segment()	2025-08-15 12:09:02 +02:00
iucv
kcm
key
l2tp
l3mdev
lapb
llc	llc: fix data loss when reading from a socket in llc_ui_recvmsg()	2025-06-04 14:42:20 +02:00
mac80211	wifi: mac80211: Write cnt before copying in ieee80211_copy_rnr_beacon()	2025-08-15 12:08:49 +02:00
mac802154
mctp	net: mctp: Ensure keys maintain only one ref to corresponding dev	2025-05-22 14:12:16 +02:00
mpls	mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu().	2025-06-27 11:09:02 +01:00
mptcp	mptcp: reset fallback status gracefully at disconnect() time	2025-08-01 09:47:32 +01:00
ncsi	net: ncsi: Fix GCPS 64-bit member variables	2025-06-19 15:28:10 +02:00
netfilter	bpf: Check netfilter ctx accesses are aligned	2025-08-15 12:08:57 +02:00
netlabel	calipso: unlock rcu before returning -EAFNOSUPPORT	2025-06-19 15:28:46 +02:00
netlink	netlink: make sure we allow at least one dump skb	2025-07-17 18:35:16 +02:00
netrom
nfc	NFC: nci: uart: Set tty->disc_data only in success path	2025-06-27 11:08:48 +01:00
nsh
openvswitch	net: openvswitch: Fix the dead loop of MPLS parse	2025-06-19 15:28:19 +02:00
packet	net/packet: fix a race in packet_set_ring() and packet_notifier()	2025-08-15 12:09:05 +02:00
phonet	phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept()	2025-07-24 08:53:12 +02:00
psample
qrtr
rds
rfkill
rose	rose: fix dangling neighbour pointers in rose_rt_device_down()	2025-07-10 16:03:11 +02:00
rxrpc	rxrpc: Fix transmission of an abort in response to an abort	2025-07-24 08:53:20 +02:00
sched	net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing	2025-08-15 12:09:03 +02:00
sctp	sctp: Do not wake readers in __sctp_write_space()	2025-06-27 11:08:53 +01:00
smc	net/smc: use the correct ndev to find pnetid by pnetid table	2025-06-04 14:41:59 +02:00
strparser
sunrpc	sunrpc: fix handling of server side tls alerts	2025-08-15 12:09:05 +02:00
switchdev
tipc	tipc: Fix use-after-free in tipc_conn_close().	2025-07-17 18:35:09 +02:00
tls	bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls	2025-08-15 12:08:44 +02:00
unix	af_unix: Don't set -ECONNRESET for consumed OOB skb.	2025-07-06 11:00:12 +02:00
vmw_vsock	vsock: Do not allow binding to VMADDR_PORT_ANY	2025-08-15 12:09:05 +02:00
wireless	wifi: prevent A-MSDU attacks in mesh networks	2025-07-17 18:35:13 +02:00
x25
xdp
xfrm	xfrm: interface: fix use-after-free after changing collect_md xfrm interface	2025-08-01 09:47:28 +01:00
compat.c
devres.c
Kconfig
Kconfig.debug
Makefile	af_unix: Remove CONFIG_UNIX_SCM.	2025-06-04 14:42:22 +02:00
socket.c
sysctl_net.c