linux/net/core
Jakub Sitnicki db38de3968 flow_dissector: Fix potential use-after-free on BPF_PROG_DETACH
Call to bpf_prog_put(), with help of call_rcu(), queues an RCU-callback to
free the program once a grace period has elapsed. The callback can run
together with new RCU readers that started after the last grace period.
New RCU readers can potentially see the "old" to-be-freed or already-freed
pointer to the program object before the RCU update-side NULLs it.

Reorder the operations so that the RCU update-side resets the protected
pointer before the end of the grace period after which the program will be
freed.

Fixes: d58e468b11 ("flow_dissector: implements flow dissector BPF hook")
Reported-by: Lorenz Bauer <lmb@cloudflare.com>
Signed-off-by: Jakub Sitnicki <jakub@cloudflare.com>
Acked-by: Petar Penkov <ppenkov@google.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
2019-08-24 01:15:34 +02:00
..
bpf_sk_storage.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2019-06-17 20:20:36 -07:00
datagram.c
datagram.h
dev_addr_lists.c
dev_ioctl.c
dev.c net: fix bpf_xdp_adjust_head regression for generic-XDP 2019-08-05 11:17:40 -07:00
devlink.c devlink: Introduce PCI VF port flavour and port attribute 2019-07-09 12:02:13 -07:00
drop_monitor.c
dst_cache.c
dst.c blackhole_netdev: use blackhole_netdev to invalidate dst entries 2019-07-01 19:34:46 -07:00
ethtool.c net: ethtool: Allow parsing ETHER_FLOW types when using flow_rule 2019-06-27 09:38:17 -07:00
failover.c
fib_notifier.c
fib_rules.c
filter.c bpf: fix access to skb_shared_info->gso_segs 2019-07-23 14:12:37 -07:00
flow_dissector.c flow_dissector: Fix potential use-after-free on BPF_PROG_DETACH 2019-08-24 01:15:34 +02:00
flow_offload.c net: flow_offload: add flow_block structure and use it 2019-07-19 21:27:45 -07:00
gen_estimator.c
gen_stats.c
gro_cells.c
hwbm.c net: hwbm: Make the hwbm_pool lock a mutex 2019-06-09 19:40:10 -07:00
link_watch.c net: link_watch: prevent starvation when processing linkwatch wq 2019-07-01 19:02:47 -07:00
lwt_bpf.c
lwtunnel.c
Makefile
neighbour.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2019-07-19 10:06:06 -07:00
net_namespace.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next 2019-07-11 10:55:49 -07:00
net-procfs.c
net-sysfs.c
net-sysfs.h
net-traces.c page_pool: add tracepoints for page_pool with details need by XDP 2019-06-19 11:23:13 -04:00
netclassid_cgroup.c
netevent.c
netpoll.c
netprio_cgroup.c
page_pool.c net: core: page_pool: add user refcnt and reintroduce page_pool_destroy 2019-07-08 14:58:04 -07:00
pktgen.c
ptp_classifier.c
request_sock.c
rtnetlink.c rtnetlink: skip metrics loop for dst_default_metrics 2019-06-26 13:14:59 -07:00
scm.c
secure_seq.c
skbuff.c skbuff: fix compilation warnings in skb_dump() 2019-07-16 14:12:06 -07:00
skmsg.c bpf: sockmap/tls, close can race with map free 2019-07-22 16:04:17 +02:00
sock_diag.c sock: make cookie generation global instead of per netns 2019-08-09 13:14:46 -07:00
sock_map.c bpf: sockmap, only create entry if ulp is not already enabled 2019-07-22 16:04:17 +02:00
sock_reuseport.c bpf: net: Add SO_DETACH_REUSEPORT_BPF 2019-06-15 01:21:19 +02:00
sock.c net/tls: prevent skb_orphan() from leaking TLS plain text with offload 2019-08-08 22:39:35 -07:00
stream.c
sysctl_net_core.c proc/sysctl: add shared variables for range check 2019-07-18 17:08:07 -07:00
timestamping.c
tso.c
utils.c
xdp.c net: core: page_pool: add user refcnt and reintroduce page_pool_destroy 2019-07-08 14:58:04 -07:00