Davide Caratti ee3bbfe806 net/sched: let actions use RCU to access 'goto_chain' ... use RCU when accessing the action chain, to avoid use after free in the traffic path when 'goto chain' is replaced on existing TC actions (see script below). Since the control action is read in the traffic path without holding the action spinlock, we need to explicitly ensure that a->goto_chain is not NULL before dereferencing (i.e it's not sufficient to rely on the value of TC_ACT_GOTO_CHAIN bits). Not doing so caused NULL dereferences in tcf_action_goto_chain_exec() when the following script: # tc chain add dev dd0 chain 42 ingress protocol ip flower \ > ip_proto udp action pass index 4 # tc filter add dev dd0 ingress protocol ip flower \ > ip_proto udp action csum udp goto chain 42 index 66 # tc chain del dev dd0 chain 42 ingress (start UDP traffic towards dd0) # tc action replace action csum udp pass index 66 was run repeatedly for several hours. Suggested-by: Cong Wang <xiyou.wangcong@gmail.com> Suggested-by: Vlad Buslov <vladbu@mellanox.com> Signed-off-by: Davide Caratti <dcaratti@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>		2019-03-21 13:26:42 -07:00
..
6lowpan	6lowpan: fix debugfs_simple_attr.cocci warnings	2019-01-22 09:51:19 +01:00
9p	9p/net: put a lower bound on msize	2018-12-25 17:07:49 +09:00
802
8021q	net: Remove switchdev.h inclusion from team/bond/vlan	2019-02-24 17:40:46 -08:00
appletalk	appletalk: Fix potential NULL pointer dereference in unregister_snap_client	2019-03-15 11:25:48 -07:00
atm	net: atm: Add another IS_ENABLED(CONFIG_COMPAT) in atm_dev_ioctl	2019-03-07 10:14:50 -08:00
ax25	ax25: fix possible use-after-free	2019-01-23 11:18:00 -08:00
batman-adv	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2019-02-15 12:38:38 -08:00
bluetooth	Bluetooth: Add quirk for reading BD_ADDR from fwnode property	2019-02-26 10:08:26 +01:00
bpf	bpf: fix warning about using plain integer as NULL	2019-03-08 21:17:07 +01:00
bpfilter	bpfilter: re-add header search paths to tools include to fix build error	2019-02-23 13:34:40 -08:00
bridge	netfilter: bridge: set skb transport_header before entering NF_INET_PRE_ROUTING	2019-03-18 16:21:54 +01:00
caif	net: caif: use skb helpers instead of open-coding them	2019-02-17 11:01:17 -08:00
can	can: bcm: check timer values before ktime conversion	2019-01-22 11:33:46 +01:00
ceph	libceph: use struct_size() for kmalloc() in crush_decode()	2019-03-05 18:55:17 +01:00
core	net-sysfs: call dev_hold if kobject_init_and_add success	2019-03-19 13:45:58 -07:00
dcb
dccp	dccp: do not use ipv6 header for ipv4 flow	2019-03-19 14:01:40 -07:00
decnet	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2019-01-29 21:18:54 -08:00
dns_resolver
dsa	net: dsa: Use prepare/commit phase in dsa_slave_vlan_rx_add_vid()	2019-03-03 20:45:52 -08:00
ethernet	net/ethernet: Add parse_protocol header_ops support	2019-02-22 12:55:31 -08:00
hsr	net/hsr: fix possible crash in add_timer()	2019-03-07 11:02:08 -08:00
ieee802154	net: remove unused struct inet_frag_queue.fragments field	2019-02-26 08:27:05 -08:00
ife
ipv4	tcp: Don't access TCP_SKB_CB before initializing it	2019-03-11 15:36:49 -07:00
ipv6	Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf	2019-03-21 10:07:00 -07:00
iucv
kcm	kcm: Remove unnecessary SLAB_PANIC for kmem_cache_create() in kcm_init	2019-02-23 13:46:24 -08:00
key	af_key: unconditionally clone on broadcast	2019-02-12 10:36:42 +01:00
l2tp	l2tp: fix infoleak in l2tp_ip6_recvmsg()	2019-03-13 14:19:35 -07:00
l3mdev	l3mdev: add function to retreive upper master	2018-12-03 14:15:26 -08:00
lapb
llc
mac80211	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2019-02-24 12:06:19 -08:00
mac802154
mpls	mpls: Fix 6PE forwarding	2019-03-19 16:00:22 -07:00
ncsi	net: ncsi: fix a missing check for nla_nest_start	2019-03-16 11:44:33 -07:00
netfilter	netfilter: nf_tables: add missing ->release_ops() in error path of newrule()	2019-03-20 08:32:58 +01:00
netlabel	netlabel: fix out-of-bounds memory accesses	2019-02-27 21:45:24 -08:00
netlink	genetlink: Fix a memory leak on error path	2019-03-21 09:29:06 -07:00
netrom	netrom: switch to sock timer API	2019-01-27 10:38:04 -08:00
nfc	nfc: Fix to check for kmemdup failure	2019-03-19 13:48:07 -07:00
nsh
openvswitch	net: openvswitch: fix missing checks for nla_nest_start	2019-03-16 11:43:14 -07:00
packet	net/packet: Set __GFP_NOWARN upon allocation in alloc_pg_vec	2019-03-20 10:46:50 -07:00
phonet	phonet: fix building with clang	2019-02-21 16:23:56 -08:00
psample
qrtr	mm: replace all open encodings for NUMA_NO_NODE	2019-03-05 21:07:14 -08:00
rds	5.1 Merge Window Pull Request	2019-03-09 15:53:03 -08:00
rfkill	rfkill: gpio: Remove unused include	2018-12-18 13:13:56 +01:00
rose	net: rose: fix a possible stack overflow	2019-03-18 16:53:22 -07:00
rxrpc	rxrpc: Fix client call queueing, waiting for channel	2019-03-08 18:24:53 -08:00
sched	net/sched: let actions use RCU to access 'goto_chain'	2019-03-21 13:26:42 -07:00
sctp	sctp: use memdup_user instead of vmemdup_user	2019-03-20 11:09:47 -07:00
smc	Merge branch 'work.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2019-03-12 13:27:20 -07:00
strparser	net: strparser: fix a missing check for create_singlethread_workqueue	2019-03-15 12:51:56 -07:00
sunrpc	Miscellaneous NFS server fixes. Probably the most visible bug is one	2019-03-12 15:06:54 -07:00
switchdev	switchdev: Remove unused transaction item queue	2019-03-01 21:35:19 -08:00
tipc	tipc: fix cancellation of topology subscriptions	2019-03-21 09:09:04 -07:00
tls	net/tls: Inform user space about send buffer availability	2019-03-13 14:16:44 -07:00
unix	io_uring-2019-03-06	2019-03-08 14:48:40 -08:00
vmw_vsock	vsock/virtio: fix kernel panic from virtio_transport_reset_no_sock	2019-03-08 15:15:44 -08:00
wimax
wireless	Merge remote-tracking branch 'net-next/master' into mac80211-next	2019-02-22 13:48:13 +01:00
x25	net/x25: reset state in x25_connect()	2019-03-11 15:40:14 -07:00
xdp	xsk: fix umem memory leak on cleanup	2019-03-16 01:27:51 +01:00
xfrm	xfrm: Fix inbound traffic via XFRM interfaces across network namespaces	2019-02-18 10:58:54 +01:00
compat.c	Merge branch 'timers-2038-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2019-03-05 14:08:26 -08:00
Kconfig	net: devlink: turn devlink into a built-in	2019-02-26 08:49:05 -08:00
Makefile	net: split out functions related to registering inflight socket files	2019-02-28 08:24:23 -07:00
socket.c	net: add documentation to socket.c	2019-03-15 15:29:47 -07:00
sysctl_net.c