tmp_suning_uos_patched/net/bridge
Dave Jones 1086bbe97a netfilter: ensure number of counters is >0 in do_replace()
After improving setsockopt() coverage in trinity, I started triggering
vmalloc failures pretty reliably from this code path:

warn_alloc_failed+0xe9/0x140
__vmalloc_node_range+0x1be/0x270
vzalloc+0x4b/0x50
__do_replace+0x52/0x260 [ip_tables]
do_ipt_set_ctl+0x15d/0x1d0 [ip_tables]
nf_setsockopt+0x65/0x90
ip_setsockopt+0x61/0xa0
raw_setsockopt+0x16/0x60
sock_common_setsockopt+0x14/0x20
SyS_setsockopt+0x71/0xd0

It turns out we don't validate that the num_counters field in the
struct we pass in from userspace is initialized.

The same problem also exists in ebtables, arptables, ipv6, and the
compat variants.

Signed-off-by: Dave Jones <davej@codemonkey.org.uk>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2015-05-20 13:46:49 +02:00
..
netfilter netfilter: ensure number of counters is >0 in do_replace() 2015-05-20 13:46:49 +02:00
br_device.c netfilter: bridge: use rcu hook to resolve br_netfilter dependency 2015-03-10 15:03:02 +01:00
br_fdb.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2015-02-09 14:35:57 -08:00
br_forward.c netfilter: Pass socket pointer down through okfn(). 2015-04-07 15:25:55 -04:00
br_if.c bridge: reset bridge mtu after deleting an interface 2015-03-14 19:12:38 -04:00
br_input.c netfilter: Pass socket pointer down through okfn(). 2015-04-07 15:25:55 -04:00
br_ioctl.c bridge: add space before '(/{', after ',', etc. 2013-12-19 19:27:26 -05:00
br_mdb.c bridge/mdb: remove wrong use of NLM_F_MULTI 2015-04-29 14:59:16 -04:00
br_multicast.c netfilter: Pass socket pointer down through okfn(). 2015-04-07 15:25:55 -04:00
br_netfilter.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next 2015-04-08 18:30:21 +02:00
br_netlink.c bridge/nl: remove wrong use of NLM_F_MULTI 2015-04-29 14:59:16 -04:00
br_nf_core.c net: Remove protocol from struct dst_ops 2015-03-09 16:06:10 -04:00
br_private_stp.h net: 8021q/bluetooth/bridge/can/ceph: Remove extern from function prototypes 2013-10-19 19:12:11 -04:00
br_private.h bridge/nl: remove wrong use of NLM_F_MULTI 2015-04-29 14:59:16 -04:00
br_stp_bpdu.c netfilter: Pass socket pointer down through okfn(). 2015-04-07 15:25:55 -04:00
br_stp_if.c net: bridge: add a br_set_state helper function 2014-10-01 22:03:50 -04:00
br_stp_timer.c net: bridge: add a br_set_state helper function 2014-10-01 22:03:50 -04:00
br_stp.c bridge: call netdev_sw_port_stp_update when bridge port STP status changes 2014-12-02 20:01:22 -08:00
br_sysfs_br.c bridge: Add a default_pvid sysfs attribute 2014-10-05 21:21:36 -04:00
br_sysfs_if.c bridge: Extend Proxy ARP design to allow optional rules for Wi-Fi 2015-03-05 14:52:23 -05:00
br_vlan.c net: rename vlan_tx_* helpers since "tx" is misleading there 2015-01-13 17:51:08 -05:00
br.c net: bridge: add compile-time assert for cb struct size 2015-03-03 14:07:04 -05:00
Kconfig bridge: Add vlan filtering infrastructure 2013-02-13 19:41:46 -05:00
Makefile netfilter: bridge: build br_nf_core only if required 2014-09-30 14:07:51 -04:00