AcoSail/kernel_optimize_test
8
0
Fork 0
forked from luck/tmp_suning_uos_patched
Code Pull Requests Activity
fe0448a3fa
kernel_optimize_test/net
History
Nikolay Aleksandrov fe0448a3fa net: bridge: fix vlan tunnel dst null pointer dereference 
commit 58e2071742e38f29f051b709a5cca014ba51166f upstream.

This patch fixes a tunnel_dst null pointer dereference due to lockless
access in the tunnel egress path. When deleting a vlan tunnel the
tunnel_dst pointer is set to NULL without waiting a grace period (i.e.
while it's still usable) and packets egressing are dereferencing it
without checking. Use READ/WRITE_ONCE to annotate the lockless use of
tunnel_id, use RCU for accessing tunnel_dst and make sure it is read
only once and checked in the egress path. The dst is already properly RCU
protected so we don't need to do anything fancy than to make sure
tunnel_id and tunnel_dst are read only once and checked in the egress path.

Cc: stable@vger.kernel.org
Fixes: 11538d039a ("bridge: vlan dst_metadata hooks in ingress and egress paths")
Signed-off-by: Nikolay Aleksandrov <nikolay@nvidia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-06-23 14:42:53 +02:00
..
6lowpan
9p net: 9p: advance iov on empty read 2021-04-07 15:00:08 +02:00
802
8021q net: vlan: avoid leaks on register_vlan_dev() failures 2021-01-17 14:16:55 +01:00
appletalk appletalk: Fix skb allocation size in loopback case 2021-04-07 15:00:08 +02:00
atm
ax25
batman-adv batman-adv: Avoid WARN_ON timing related checks 2021-06-23 14:42:41 +02:00
bluetooth Bluetooth: use correct lock to prevent UAF of hdev object 2021-06-10 13:39:23 +02:00
bpf bpf: Reject too big ctx_size_in for raw_tp test run 2021-01-27 11:55:07 +01:00
bpfilter
bridge net: bridge: fix vlan tunnel dst null pointer dereference 2021-06-23 14:42:53 +02:00
caif net: caif: fix memory leak in cfusbl_device_notify 2021-06-10 13:39:25 +02:00
can can: j1939: fix Use-after-Free, hold skb ref while in use 2021-06-23 14:42:50 +02:00
ceph
core net: make get_net_ns return error if NET_NS is disabled 2021-06-23 14:42:44 +02:00
dcb net: dcb: Accept RTM_GETDCB messages carrying set-like DCB commands 2021-01-23 16:04:01 +01:00
dccp ipv6: weaken the v4mapped source check 2021-03-30 14:32:01 +02:00
decnet
dns_resolver
dsa net: dsa: tag_8021q: fix the VLAN IDs used for encoding sub-VLANs 2021-06-10 13:39:17 +02:00
ethernet
ethtool ethtool: strset: fix message length calculation 2021-06-23 14:42:45 +02:00
hsr net: hsr: fix mac_len checks 2021-06-03 09:00:50 +02:00
ieee802154 net: ieee802154: fix null deref in parse dev addr 2021-06-18 10:00:03 +02:00
ife
ipv4 icmp: don't send out ICMP messages with a source address of 0.0.0.0 2021-06-23 14:42:47 +02:00
ipv6 udp: fix race between close() and udp_abort() 2021-06-23 14:42:42 +02:00
iucv net/af_iucv: remove WARN_ONCE on malformed RX packets 2021-03-07 12:34:05 +01:00
kcm
key af_key: relax availability checks for skb size calculation 2021-02-13 13:55:02 +01:00
l2tp net: l2tp: reduce log level of messages in receive path, add counter instead 2021-03-17 17:06:11 +01:00
l3mdev
lapb net: lapb: Copy the skb before sending a packet 2021-02-10 09:29:14 +01:00
llc
mac80211 mac80211: Fix NULL ptr deref for injected rate info 2021-06-23 14:42:52 +02:00
mac802154 net: mac802154: Fix general protection fault 2021-04-14 08:42:13 +02:00
mpls net: avoid infinite loop in mpls_gso_segment when mpls_hlen == 0 2021-03-17 17:06:11 +01:00
mptcp mptcp: do not warn on bad input from the network 2021-06-23 14:42:43 +02:00
ncsi net/ncsi: Avoid channel_monitor hrtimer deadlock 2021-04-14 08:42:08 +02:00
netfilter netfilter: synproxy: Fix out of bounds when parsing TCP options 2021-06-23 14:42:43 +02:00
netlabel cipso,calipso: resolve a number of problems with the DOI refcounts 2021-03-17 17:06:15 +01:00
netlink netlink: disable IRQs for netlink_lock_table() 2021-06-16 12:01:36 +02:00
netrom
nfc net/nfc/rawsock.c: fix a permission check bug 2021-06-16 12:01:35 +02:00
nsh
openvswitch openvswitch: meter: fix race when getting now_ms. 2021-06-03 09:00:47 +02:00
packet net: packetmmap: fix only tx timestamp on request 2021-06-03 09:00:46 +02:00
phonet
psample net: psample: Fix netlink skb length with tunnel info 2021-03-07 12:34:07 +01:00
qrtr net: qrtr: fix OOB Read in qrtr_endpoint_post 2021-06-23 14:42:45 +02:00
rds net: rds: fix memory leak in rds_recvmsg 2021-06-23 14:42:42 +02:00
rfkill
rose
rxrpc rxrpc: Fix clearance of Tx/Rx ring when releasing a call 2021-02-17 11:02:28 +01:00
sched sch_cake: Fix out of bounds when parsing TCP options and header 2021-06-23 14:42:43 +02:00
sctp sctp: fix a SCTP_MIB_CURRESTAB leak in sctp_sf_do_dupcook_b 2021-05-19 10:13:06 +02:00
smc net/smc: remove device from smcd_dev_list after failed device_add() 2021-06-03 09:00:48 +02:00
strparser
sunrpc SUNRPC: More fixes for backlog congestion 2021-06-03 09:00:51 +02:00
switchdev net: switchdev: don't set port_obj_info->handled true when -EOPNOTSUPP 2021-02-07 15:37:12 +01:00
tipc tipc: fix unique bearer names sanity check 2021-06-10 13:39:22 +02:00
tls net/tls: Fix use-after-free after the TLS device goes down and up 2021-06-10 13:39:18 +02:00
unix net/af_unix: fix a data-race in unix_dgram_sendmsg / unix_release_sock 2021-06-23 14:42:46 +02:00
vmw_vsock vsock/virtio: free queued packets when closing socket 2021-05-14 09:50:41 +02:00
wimax
wireless cfg80211: avoid double free of PMSR request 2021-06-23 14:42:53 +02:00
x25 net/x25: Return the correct errno code 2021-06-18 10:00:06 +02:00
xdp xsk: Fix for xp_aligned_validate_desc() when len == chunk_size 2021-05-19 10:13:06 +02:00
xfrm xfrm: BEET mode doesn't support fragments for inner packets 2021-04-21 13:00:51 +02:00
compat.c net: Return the correct errno code 2021-06-18 10:00:06 +02:00
devres.c
Kconfig
Makefile
socket.c net: make get_net_ns return error if NET_NS is disabled 2021-06-23 14:42:44 +02:00
sysctl_net.c