Martin KaFai Lau
62241d6d9e
net: Unpublish sk from sk_reuseport_cb before call_rcu
...
[ Upstream commit 8c7138b33e5c690c308b2a7085f6313fdcb3f616 ]
The "reuse->sock[]" array is shared by multiple sockets. The going away
sk must unpublish itself from "reuse->sock[]" before making call_rcu()
call. However, this unpublish-action is currently done after a grace
period and it may cause use-after-free.
The fix is to move reuseport_detach_sock() to sk_destruct().
Due to the above reason, any socket with sk_reuseport_cb has
to go through the rcu grace period before freeing it.
It is a rather old bug (~3 yrs). The Fixes tag is not necessary
the right commit but it is the one that introduced the SOCK_RCU_FREE
logic and this fix is depending on it.
Fixes: a4298e4522 ("net: add SOCK_RCU_FREE socket flag")
Cc: Eric Dumazet <eric.dumazet@gmail.com>
Suggested-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: Martin KaFai Lau <kafai@fb.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-10-07 18:53:21 +02:00
..
datagram.c
net: udp: fix handling of CHECKSUM_COMPLETE packets
2018-11-10 07:42:58 -08:00
dev.c
net: Fix null de-reference of device refcount
2019-09-21 07:14:02 +02:00
dev_addr_lists.c
net: fix uninit-value in __hw_addr_add_ex()
2018-05-16 10:08:41 +02:00
dev_ioctl.c
net: Zero terminate ifr_name in dev_ifname().
2017-08-11 08:49:32 -07:00
devlink.c
devlink: add hardware messages tracing facility
2016-07-12 14:20:18 -07:00
drop_monitor.c
drop_monitor: consider inserted data in genlmsg_end
2017-01-15 13:42:54 +01:00
dst.c
Fix an intermittent pr_emerg warning about lo becoming free.
2017-07-05 14:40:14 +02:00
dst_cache.c
net: dst_cache_per_cpu_dst_set() can be static
2016-03-18 17:45:08 -04:00
ethtool.c
ethtool: check the return value of get_regs_len
2019-06-11 12:22:49 +02:00
fib_rules.c
Revert "fib_rules: return 0 directly if an exactly same rule exists when NLM_F_EXCL not supplied"
2019-06-11 12:22:47 +02:00
filter.c
bpf: fix 32-bit divide by zero
2018-01-31 12:55:57 +01:00
flow.c
flowcache: Increase threshold for refusing new allocations
2016-11-23 06:37:09 +01:00
flow_dissector.c
flow_dissector: do not dissect l4 ports for fragments
2018-11-23 08:20:34 +01:00
gen_estimator.c
net: sched: do not acquire qdisc spinlock in qdisc/class stats dump
2016-06-07 16:37:14 -07:00
gen_stats.c
gen_stats: Fix netlink stats dumping in the presence of padding
2018-07-25 11:24:00 +02:00
hwbm.c
net: hwbm: Fix unbalanced spinlock in error case
2016-05-25 12:35:09 -07:00
link_watch.c
dev: introduce dev_get_iflink()
2015-04-02 14:04:59 -04:00
lwtunnel.c
lwtunnel: Fix oops on state free after encap module unload
2017-02-04 09:47:11 +01:00
Makefile
net: add a hardware buffer management helper API
2016-03-14 12:19:46 -04:00
neighbour.c
net: neigh: fix multiple neigh timer scheduling
2019-08-04 09:33:33 +02:00
net-procfs.c
net: remove NETDEV_TX_LOCKED support
2016-04-26 15:53:05 -04:00
net-sysfs.c
net-sysfs: Fix mem leak in netdev_register_kobject
2019-03-13 14:04:52 -07:00
net-sysfs.h
net-traces.c
net: IPv6 fib lookup tracepoint
2015-11-22 11:54:10 -05:00
net_namespace.c
netns: provide pure entropy for net_hash_mix()
2019-04-17 08:36:46 +02:00
netclassid_cgroup.c
cgroup, netclassid: add a preemption point to write_classid
2018-11-13 11:16:51 -08:00
netevent.c
netevent: remove automatic variable in register_netevent_notifier()
2015-05-31 00:03:21 -07:00
netpoll.c
net: fix skb use after free in netpoll
2019-09-10 10:31:04 +01:00
netprio_cgroup.c
core: remove unneded headers for net cgroup controllers.
2016-02-17 15:31:27 -05:00
pktgen.c
pktgen: do not sleep with the thread lock held.
2019-06-11 12:22:46 +02:00
ptp_classifier.c
ptp: Change ptp_class to a proper bitmask
2015-11-03 11:08:22 -05:00
request_sock.c
tcp: restore fastopen operations
2015-10-05 03:19:06 -07:00
rtnetlink.c
rtnetlink: ndo_dflt_fdb_dump() only work for ARPHRD_ETHER devices
2018-12-17 09:38:31 +01:00
scm.c
unix: correctly track in-flight fds in sending process user_struct
2016-02-08 10:30:42 -05:00
secure_seq.c
net: remove a sparse error in secure_dccpv6_sequence_number()
2015-05-25 22:55:37 -04:00
skbuff.c
net: gso: Fix skb_segment splat when splitting gso_size mangled skb having linear-headed frag_list
2019-09-21 07:14:02 +02:00
sock.c
net: Unpublish sk from sk_reuseport_cb before call_rcu
2019-10-07 18:53:21 +02:00
sock_diag.c
net: core: fix module type in sock_diag_bind
2018-01-17 09:38:53 +01:00
sock_reuseport.c
soreuseport: fix mem leak in reuseport_add_sock()
2018-02-13 12:35:57 +01:00
stream.c
tcp: make sure EPOLLOUT wont be missed
2019-09-06 10:19:45 +02:00
sysctl_net_core.c
bpf: fix bpf_jit_limit knob for PAGE_SIZE >= 64K
2019-08-25 10:51:50 +02:00
timestamping.c
net: skb_defer_rx_timestamp should check for phydev before setting up classify
2015-07-09 14:17:15 -07:00
tso.c
net: tso: add support for IPv6
2015-10-26 22:24:22 -07:00
utils.c
net: the space is required before the open parenthesis '('
2016-06-29 05:15:14 -04:00