diff options
| author |   Jakub Kicinski <kuba@kernel.org> | 2026-10-01 18:11:13 -0700 |
|---|---|---|
| committer | Jakub Kicinski <kuba@kernel.org> | 2026-10-01 18:11:14 -0700 |
| commit | 2d3b94c6076a95553876a3c45c122edf62c27449 (patch) | |
| tree | 84d860b87889dfc690b371061ab7d163e25c3f0f /scripts/objdiff | |
| parent | net/sched: em_text: reject unterminated algo before autoload (diff) | |
| parent | selftests: net: amt: check that the relay's queries bypass the amt device (diff) | |
Merge branch 'amt-send-the-relay-s-general-query-directly-from-the-receive-path'
Omar Ramadan says:
====================
amt: send the relay's General Query directly from the receive path
The relay queues its General Query on the amt device with a raw tunnel
pointer in skb->cb, and a query that waits in a qdisc can outlive its
tunnel: a use-after-free in amt_dev_xmit(), reported by Microsoft with
a KASAN reproducer. Patch 1 sends the query directly from
amt_request_handler(), inside the RCU section that found or created
the tunnel, so it never waits in a qdisc and nothing is stored in
skb->cb.
Patch 2 adds the selftest Taehee asked for. It counts the queries that
leave the relay through its amt device and expects none. It fails
without patch 1 and passes with it.
====================
Link: https://patch.msgid.link/20260928202312.74574-1-omar@blockcast.net
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Diffstat (limited to 'scripts/objdiff')
0 files changed, 0 insertions, 0 deletions