diff options
| author | Jakub Kicinski <kuba@kernel.org> | 2026-10-01 18:11:13 -0700 |
|---|---|---|
| committer | Jakub Kicinski <kuba@kernel.org> | 2026-10-01 18:11:14 -0700 |
| commit | 2d3b94c6076a95553876a3c45c122edf62c27449 (patch) | |
| tree | 84d860b87889dfc690b371061ab7d163e25c3f0f /tools/perf/scripts/python/stackcollapse.py | |
| parent | c9728fcf2e7fb4a7a8d08ebd9524c3b02ae1a021 (diff) | |
| parent | c41817fcaf397f6ff7c530b682581f5eb5465844 (diff) | |
| download | linux-2d3b94c6076a95553876a3c45c122edf62c27449.tar.gz linux-2d3b94c6076a95553876a3c45c122edf62c27449.zip | |
Merge branch 'amt-send-the-relay-s-general-query-directly-from-the-receive-path'
Omar Ramadan says:
====================
amt: send the relay's General Query directly from the receive path
The relay queues its General Query on the amt device with a raw tunnel
pointer in skb->cb, and a query that waits in a qdisc can outlive its
tunnel: a use-after-free in amt_dev_xmit(), reported by Microsoft with
a KASAN reproducer. Patch 1 sends the query directly from
amt_request_handler(), inside the RCU section that found or created
the tunnel, so it never waits in a qdisc and nothing is stored in
skb->cb.
Patch 2 adds the selftest Taehee asked for. It counts the queries that
leave the relay through its amt device and expects none. It fails
without patch 1 and passes with it.
====================
Link: https://patch.msgid.link/20260928202312.74574-1-omar@blockcast.net
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Diffstat (limited to 'tools/perf/scripts/python/stackcollapse.py')
0 files changed, 0 insertions, 0 deletions