From: Jakub Kicinski <kuba@kernel.org>
Date: Thu, 18 Sep 2025 01:10:24 +0000 (-0700)
Subject: Merge branch 'net-fix-uaf-of-sk_dst_get-sk-dev'
X-Git-Tag: v6.18-rc1~132^2~137
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=e218ae40241c162a752200efec92030d4de1b503;p=thirdparty%2Flinux.git

Merge branch 'net-fix-uaf-of-sk_dst_get-sk-dev'

Kuniyuki Iwashima says:

====================
net: Fix UAF of sk_dst_get(sk)->dev.

syzbot caught use-after-free of sk_dst_get(sk)->dev,
which was not fetched under RCU nor RTNL. [0]

Patch 1 ~ 5, 7 fix UAF in smc, tcp, ktls, mptcp
Patch 6 fixes dst ref leak in mptcp

[0]: https://lore.kernel.org/68c237c7.050a0220.3c6139.0036.GAE@google.com

v1: https://lore.kernel.org/20250911030620.1284754-1-kuniyu@google.com
====================

Link: https://patch.msgid.link/20250916214758.650211-1-kuniyu@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
---

e218ae40241c162a752200efec92030d4de1b503