Skip to main content

Browse the archive

https://github.com/torvalds/linux
05 April 2024, 19:05:47 UTC
Revision b4681c2829e24943aadd1a7bb3a30d41d0a20050 authored by Ido Schimmel on 20 December 2017, 17:34:19 UTC, committed by David S. Miller on 20 December 2017, 20:12:39 UTC 
ipv4: Fix use-after-free when flushing FIB tables
 
Since commit 0ddcf43d5d4a ("ipv4: FIB Local/MAIN table collapse") the
local table uses the same trie allocated for the main table when custom
rules are not in use.

When a net namespace is dismantled, the main table is flushed and freed
(via an RCU callback) before the local table. In case the callback is
invoked before the local table is iterated, a use-after-free can occur.

Fix this by iterating over the FIB tables in reverse order, so that the
main table is always freed after the local table.

v3: Reworded comment according to Alex's suggestion.
v2: Add a comment to make the fix more explicit per Dave's and Alex's
feedback.

Fixes: 0ddcf43d5d4a ("ipv4: FIB Local/MAIN table collapse")
Signed-off-by: Ido Schimmel <idosch@mellanox.com>
Reported-by: Fengguang Wu <fengguang.wu@intel.com>
Acked-by: Alexander Duyck <alexander.h.duyck@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
1 parent ad3cbf6
History
Tip revision: b4681c2829e24943aadd1a7bb3a30d41d0a20050 authored by Ido Schimmel on 20 December 2017, 17:34:19 UTC
ipv4: Fix use-after-free when flushing FIB tables
Tip revision: b4681c2
File Mode Size
Documentation
arch
block
certs
crypto
drivers
firmware
fs
include
init
ipc
kernel
lib
mm
net
samples
scripts
security
sound
tools
usr
virt
.cocciconfig -rw-r--r-- 59 bytes
.get_maintainer.ignore -rw-r--r-- 31 bytes
.gitattributes -rw-r--r-- 30 bytes
.gitignore -rw-r--r-- 1.4 KB
.mailmap -rw-r--r-- 8.8 KB
COPYING -rw-r--r-- 18.3 KB
CREDITS -rw-r--r-- 96.2 KB
Kbuild -rw-r--r-- 2.2 KB
Kconfig -rw-r--r-- 287 bytes
MAINTAINERS -rw-r--r-- 426.4 KB
Makefile -rw-r--r-- 58.3 KB
README -rw-r--r-- 722 bytes

README

back to top