Nikolay Aleksandrov 9d332e69c1 net: bridge: fix vlan stats use-after-free on destruction ... Syzbot reported a use-after-free of the global vlan context on port vlan destruction. When I added per-port vlan stats I missed the fact that the global vlan context can be freed before the per-port vlan rcu callback. There're a few different ways to deal with this, I've chosen to add a new private flag that is set only when per-port stats are allocated so we can directly check it on destruction without dereferencing the global context at all. The new field in net_bridge_vlan uses a hole. v2: cosmetic change, move the check to br_process_vlan_info where the other checks are done v3: add change log in the patch, add private (in-kernel only) flags in a hole in net_bridge_vlan struct and use that instead of mixing user-space flags with private flags Fixes: 9163a0fc1f ("net: bridge: add support for per-port vlan stats") Reported-by: syzbot+04681da557a0e49a52e5@syzkaller.appspotmail.com Signed-off-by: Nikolay Aleksandrov <nikolay@cumulusnetworks.com> Signed-off-by: David S. Miller <davem@davemloft.net>		2018-11-17 21:38:44 -08:00
..
6lowpan
9p	Merge branch 'work.afs' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2018-11-03 10:35:52 -07:00
802
8021q	netpoll: allow cleanup to be synchronous	2018-10-19 17:01:43 -07:00
appletalk
atm	Revert "net: simplify sock_poll_wait"	2018-10-23 10:57:06 -07:00
ax25	ax25: remove blank line at EOF	2018-07-24 14:10:42 -07:00
batman-adv	batman-adv: Expand merged fragment buffer for full packet	2018-11-12 10:41:29 +01:00
bluetooth	Merge branch 'work.afs' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2018-11-01 19:58:52 -07:00
bpf	bpf: add tests for direct packet access from CGROUP_SKB	2018-10-19 13:49:34 -07:00
bpfilter	net: bpfilter: Set user mode helper's command line	2018-10-22 19:37:36 -07:00
bridge	net: bridge: fix vlan stats use-after-free on destruction	2018-11-17 21:38:44 -08:00
caif	Revert "net: simplify sock_poll_wait"	2018-10-23 10:57:06 -07:00
can	can: raw: check for CAN FD capable netdev in raw_sendmsg()	2018-11-09 17:19:34 +01:00
ceph	Merge branch 'work.afs' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2018-11-01 19:58:52 -07:00
core	flow_dissector: do not dissect l4 ports for fragments	2018-11-09 20:01:21 -08:00
dcb	net: dcb: Add priority-to-DSCP map getters	2018-07-27 13:17:50 -07:00
dccp	Revert "net: simplify sock_poll_wait"	2018-10-23 10:57:06 -07:00
decnet	decnet: Remove unnecessary check for dev->name	2018-09-21 19:48:36 -07:00
dns_resolver	dns: Allow the dns resolver to retrieve a server set	2018-10-04 09:40:52 -07:00
dsa	net: dsa: legacy: simplify getting .driver_data	2018-10-22 19:49:04 -07:00
ethernet
hsr
ieee802154	net/ipfrag: let ip[6]frag_high_thresh in ns be higher than in init_net	2018-09-21 19:45:52 -07:00
ife
ipv4	inet: frags: better deal with smp races	2018-11-08 18:40:30 -08:00
ipv6	ipv6: fix a dst leak when removing its exception	2018-11-16 19:44:15 -08:00
iucv	Revert "net: simplify sock_poll_wait"	2018-10-23 10:57:06 -07:00
kcm	Revert "kcm: remove any offset before parsing messages"	2018-09-17 18:43:42 -07:00
key	Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next	2018-07-27 09:33:37 -07:00
l2tp	l2tp: fix a sock refcnt leak in l2tp_tunnel_register	2018-11-14 22:49:31 -08:00
l3mdev
lapb
llc	llc: do not use sk_eat_skb()	2018-10-22 19:59:20 -07:00
mac80211	mac80211: implement ieee80211_tx_rate_update to update rate	2018-10-12 13:05:40 +02:00
mac802154	mac802154: Remove VLA usage of skcipher	2018-09-28 12:46:07 +08:00
mpls	net/mpls: Handle kernel side filtering of route dumps	2018-10-16 00:14:07 -07:00
ncsi	net/ncsi: Add NCSI Broadcom OEM command	2018-10-17 22:14:54 -07:00
netfilter	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2018-11-06 07:44:04 -08:00
netlabel	netlabel: check for IPV4MASK in addrinfo_get	2018-09-21 18:58:34 -07:00
netlink	netlink: Add answer_flags to netlink_callback	2018-10-16 00:13:12 -07:00
netrom
nfc	Merge branch 'work.tty-ioctl' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2018-10-24 14:43:41 +01:00
nsh
openvswitch	openvswitch: fix linking without CONFIG_NF_CONNTRACK_LABELS	2018-11-03 19:28:44 -07:00
packet	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2018-10-06 14:43:42 -07:00
phonet
psample
qrtr
rds	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2018-10-12 21:38:46 -07:00
rfkill	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2018-09-04 21:33:03 -07:00
rose
rxrpc	rxrpc: Fix life check	2018-11-15 11:35:40 -08:00
sched	net/sched: act_pedit: fix memory leak when IDR allocation fails	2018-11-16 19:53:45 -08:00
sctp	sctp: define SCTP_SS_DEFAULT for Stream schedulers	2018-11-03 19:40:29 -07:00
smc	Merge branch 'work.afs' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2018-11-01 19:58:52 -07:00
strparser	bpf, sockmap: convert to generic sk_msg interface	2018-10-15 12:23:19 -07:00
sunrpc	NFS client bugfixes for Linux 4.20	2018-11-04 08:20:09 -08:00
switchdev
tipc	tipc: fix link re-establish failure	2018-11-11 10:03:38 -08:00
tls	Merge branch 'work.afs' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2018-11-01 19:58:52 -07:00
unix	Revert "net: simplify sock_poll_wait"	2018-10-23 10:57:06 -07:00
vmw_vsock	vsock: split dwork to avoid reinitializations	2018-08-07 12:39:13 -07:00
wimax	wimax: remove blank lines at EOF	2018-07-24 14:10:42 -07:00
wireless	nl80211: Add per peer statistics to compute FCS error rate	2018-10-12 12:56:34 +02:00
x25	x25: remove blank lines at EOF	2018-07-24 14:10:42 -07:00
xdp	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2018-10-19 11:03:06 -07:00
xfrm	Merge branch 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2018-11-03 18:25:17 -07:00
compat.c	y2038: socket: Change recvmmsg to use __kernel_timespec	2018-08-29 15:42:24 +02:00
Kconfig	bpf, sockmap: convert to generic sk_msg interface	2018-10-15 12:23:19 -07:00
Makefile
socket.c	socket: do a generic_file_splice_read when proto_ops has no splice_read	2018-11-17 21:34:11 -08:00
sysctl_net.c