https://github.com/torvalds/linux
Revision d7aa04a5e82b4f254d306926c81eae8df69e5200 authored by Roman Kapl on 20 November 2017, 21:21:13 UTC, committed by David S. Miller on 23 November 2017, 16:25:37 UTC
If you flush (delete) a filter chain other than chain 0 (such as when deleting the device), the kernel may run into a use-after-free. The chain refcount must not be decremented unless we are sure we are done with the chain. To reproduce the bug, run: ip link add dtest type dummy tc qdisc add dev dtest ingress tc filter add dev dtest chain 1 parent ffff: flower ip link del dtest Introduced in: commit f93e1cdcf42c ("net/sched: fix filter flushing"), but unless you have KAsan or luck, you won't notice it until commit 0dadc117ac8b ("cls_flower: use tcf_exts_get_net() before call_rcu()") Fixes: f93e1cdcf42c ("net/sched: fix filter flushing") Acked-by: Jiri Pirko <jiri@mellanox.com> Signed-off-by: Roman Kapl <code@rkapl.cz> Signed-off-by: David S. Miller <davem@davemloft.net>
1 parent 0cc0350
Tip revision: d7aa04a5e82b4f254d306926c81eae8df69e5200 authored by Roman Kapl on 20 November 2017, 21:21:13 UTC
net: sched: fix crash when deleting secondary chains
net: sched: fix crash when deleting secondary chains
Tip revision: d7aa04a
File | Mode | Size |
---|---|---|
6lowpan | ||
802 | ||
8021q | ||
9p | ||
appletalk | ||
atm | ||
ax25 | ||
batman-adv | ||
bluetooth | ||
bpf | ||
bridge | ||
caif | ||
can | ||
ceph | ||
core | ||
dcb | ||
dccp | ||
decnet | ||
dns_resolver | ||
dsa | ||
ethernet | ||
hsr | ||
ieee802154 | ||
ife | ||
ipv4 | ||
ipv6 | ||
ipx | ||
iucv | ||
kcm | ||
key | ||
l2tp | ||
l3mdev | ||
lapb | ||
llc | ||
mac80211 | ||
mac802154 | ||
mpls | ||
ncsi | ||
netfilter | ||
netlabel | ||
netlink | ||
netrom | ||
nfc | ||
nsh | ||
openvswitch | ||
packet | ||
phonet | ||
psample | ||
qrtr | ||
rds | ||
rfkill | ||
rose | ||
rxrpc | ||
sched | ||
sctp | ||
smc | ||
strparser | ||
sunrpc | ||
switchdev | ||
tipc | ||
tls | ||
unix | ||
vmw_vsock | ||
wimax | ||
wireless | ||
x25 | ||
xfrm | ||
Kconfig | -rw-r--r-- | 13.7 KB |
Makefile | -rw-r--r-- | 2.5 KB |
compat.c | -rw-r--r-- | 24.3 KB |
socket.c | -rw-r--r-- | 84.3 KB |
sysctl_net.c | -rw-r--r-- | 3.0 KB |
Computing file changes ...