Thadeu Lima de Souza Cascardo 9ad36309e2 net_sched: cls_route: remove from list when handle is 0 ... When a route filter is replaced and the old filter has a 0 handle, the old one won't be removed from the hashtable, while it will still be freed. The test was there since before commit 1109c00547 ("net: sched: RCU cls_route"), when a new filter was not allocated when there was an old one. The old filter was reused and the reinserting would only be necessary if an old filter was replaced. That was still wrong for the same case where the old handle was 0. Remove the old filter from the list independently from its handle value. This fixes CVE-2022-2588, also reported as ZDI-CAN-17440. Reported-by: Zhenpeng Lin <zplin@u.northwestern.edu> Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com> Reviewed-by: Kamal Mostafa <kamal@canonical.com> Cc: <stable@vger.kernel.org> Acked-by: Jamal Hadi Salim <jhs@mojatatu.com> Link: https://lore.kernel.org/r/20220809170518.164662-1-cascardo@canonical.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>		2022-08-10 22:53:11 -07:00
..
Kconfig	net: sched: incorrect Kconfig dependencies on Netfilter modules	2020-12-09 15:49:29 -08:00
Makefile	net/sched: sch_frag: add generic packet fragment support.	2020-11-27 14:36:02 -08:00
act_api.c	net/sched: act_api: Notify user space if any actions were flushed before error	2022-06-27 21:51:23 -07:00
act_bpf.c	bpf: Keep the (rcv) timestamp behavior for the existing tc-bpf@ingress	2022-03-03 14:38:48 +00:00
act_connmark.c	flow_offload: fill flags to action structure	2021-12-19 14:08:47 +00:00
act_csum.c	net/sched: act_api: Add extack to offload_act_setup() callback	2022-04-08 13:45:43 +01:00
act_ct.c	net/sched: act_ct: set 'net' pointer when creating new nf_flow_table	2022-07-11 16:25:14 +02:00
act_ctinfo.c	flow_offload: fill flags to action structure	2021-12-19 14:08:47 +00:00
act_gact.c	net/sched: act_gact: Add extack messages for offload failure	2022-04-08 13:45:43 +01:00
act_gate.c	net/sched: act_api: Add extack to offload_act_setup() callback	2022-04-08 13:45:43 +01:00
act_ife.c	flow_offload: fill flags to action structure	2021-12-19 14:08:47 +00:00
act_ipt.c	flow_offload: fill flags to action structure	2021-12-19 14:08:47 +00:00
act_meta_mark.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152	2019-05-30 11:26:32 -07:00
act_meta_skbprio.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152	2019-05-30 11:26:32 -07:00
act_meta_skbtcindex.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152	2019-05-30 11:26:32 -07:00
act_mirred.c	net: rename reference+tracking helpers	2022-06-09 21:52:55 -07:00
act_mpls.c	net/sched: act_mpls: Add extack messages for offload failure	2022-04-08 13:45:43 +01:00
act_nat.c	flow_offload: fill flags to action structure	2021-12-19 14:08:47 +00:00
act_pedit.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2022-05-19 11:23:59 -07:00
act_police.c	net/sched: act_police: allow 'continue' action offload	2022-07-06 12:44:39 +01:00
act_sample.c	net/sched: act_api: Add extack to offload_act_setup() callback	2022-04-08 13:45:43 +01:00
act_simple.c	flow_offload: fill flags to action structure	2021-12-19 14:08:47 +00:00
act_skbedit.c	net: sched: support hash selecting tx queue	2022-04-19 12:20:45 +02:00
act_skbmod.c	flow_offload: fill flags to action structure	2021-12-19 14:08:47 +00:00
act_tunnel_key.c	net/sched: act_tunnel_key: Add extack message for offload failure	2022-04-08 13:45:43 +01:00
act_vlan.c	net/sched: act_vlan: Add extack message for offload failure	2022-04-08 13:45:43 +01:00
cls_api.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2022-07-21 13:03:39 -07:00
cls_basic.c	net_sched: refactor TC action init API	2021-08-02 10:24:38 +01:00
cls_bpf.c	bpf: Keep the (rcv) timestamp behavior for the existing tc-bpf@ingress	2022-03-03 14:38:48 +00:00
cls_cgroup.c	net_sched: refactor TC action init API	2021-08-02 10:24:38 +01:00
cls_flow.c	net_sched: refactor TC action init API	2021-08-02 10:24:38 +01:00
cls_flower.c	net/sched: flower: Add PPPoE filter	2022-07-26 10:20:29 -07:00
cls_fw.c	net_sched: refactor TC action init API	2021-08-02 10:24:38 +01:00
cls_matchall.c	net/sched: matchall: Avoid overwriting error messages	2022-04-08 13:45:43 +01:00
cls_route.c	net_sched: cls_route: remove from list when handle is 0	2022-08-10 22:53:11 -07:00
cls_rsvp.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152	2019-05-30 11:26:32 -07:00
cls_rsvp.h	net_sched: refactor TC action init API	2021-08-02 10:24:38 +01:00
cls_rsvp6.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152	2019-05-30 11:26:32 -07:00
cls_tcindex.c	net_sched: refactor TC action init API	2021-08-02 10:24:38 +01:00
cls_u32.c	net/sched: cls_u32: fix possible leak in u32_init_knode()	2022-04-15 14:26:11 -07:00
em_canid.c	net: sched: kerneldoc fixes	2020-07-13 17:20:40 -07:00
em_cmp.c	net: sched: fix misspellings using misspell-fixer tool	2020-11-10 17:00:28 -08:00
em_ipset.c	sched: consistently handle layer3 header accesses in the presence of VLANs	2020-07-03 14:34:53 -07:00
em_ipt.c	sched: consistently handle layer3 header accesses in the presence of VLANs	2020-07-03 14:34:53 -07:00
em_meta.c	net_sched: em_meta: add READ_ONCE() in var_sk_bound_if()	2022-05-16 10:31:06 +01:00
em_nbyte.c	net: sched: Return the correct errno code	2021-02-06 11:15:28 -08:00
em_text.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152	2019-05-30 11:26:32 -07:00
em_u32.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152	2019-05-30 11:26:32 -07:00
ematch.c	net: sched: Fix spelling mistakes	2021-05-31 22:44:56 -07:00
sch_api.c	net: rename reference+tracking helpers	2022-06-09 21:52:55 -07:00
sch_atm.c	net: sched: Remove Qdisc::running sequence counter	2021-10-18 12:54:41 +01:00
sch_blackhole.c	Revert "net: sched: Pass root lock to Qdisc_ops.enqueue"	2020-07-16 16:48:34 -07:00
sch_cake.c	sch_cake: revise Diffserv docs	2022-01-07 08:41:29 -08:00
sch_cbq.c	net/sched: sch_cbq: change the type of cbq_set_lss to void	2022-07-27 18:30:18 -07:00
sch_cbs.c	net: don't include ethtool.h from netdevice.h	2020-11-23 17:27:04 -08:00
sch_choke.c	net: sched: validate stab values	2021-03-10 15:47:52 -08:00
sch_codel.c	Revert "net: sched: Pass root lock to Qdisc_ops.enqueue"	2020-07-16 16:48:34 -07:00
sch_drr.c	net: sched: Remove Qdisc::running sequence counter	2021-10-18 12:54:41 +01:00
sch_dsmark.c	net/sched: store the last executed chain also for clsact egress	2021-07-29 22:17:37 +01:00
sch_etf.c	Revert "net: sched: Pass root lock to Qdisc_ops.enqueue"	2020-07-16 16:48:34 -07:00
sch_ets.c	net/sched: sch_ets: don't remove idle classes from the round-robin list	2021-12-13 12:30:23 +00:00
sch_fifo.c	net_sched: fix NULL deref in fifo_set_limit()	2021-10-01 14:59:10 -07:00
sch_fq.c	Revert "net: sched: Pass root lock to Qdisc_ops.enqueue"	2020-07-16 16:48:34 -07:00
sch_fq_codel.c	fq_codel: generalise ce_threshold marking for subset of traffic	2021-10-20 15:24:36 -07:00
sch_fq_pie.c	net/sched: fq_pie: prevent dismantle issue	2021-12-09 08:01:00 -08:00
sch_frag.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next	2021-12-31 14:35:40 +00:00
sch_generic.c	net/sched: remove hacks added to dev_trans_start() for bonding to work	2022-08-03 19:20:13 -07:00
sch_gred.c	net: sched: gred: dynamically allocate tc_gred_qopt_offload	2021-10-27 12:06:52 -07:00
sch_hfsc.c	net: sched: Remove Qdisc::running sequence counter	2021-10-18 12:54:41 +01:00
sch_hhf.c	Revert "net: sched: Pass root lock to Qdisc_ops.enqueue"	2020-07-16 16:48:34 -07:00
sch_htb.c	sch_htb: Fail on unsupported parameters when offload is requested	2022-01-25 20:00:02 -08:00
sch_ingress.c	net: sched: Pass ingress block to tcf_classify_ingress	2020-02-19 17:49:48 -08:00
sch_mq.c	net: sched: Remove Qdisc::running sequence counter	2021-10-18 12:54:41 +01:00
sch_mqprio.c	net: sched: Remove Qdisc::running sequence counter	2021-10-18 12:54:41 +01:00
sch_multiq.c	net: sched: Remove Qdisc::running sequence counter	2021-10-18 12:54:41 +01:00
sch_netem.c	net/sched: sch_netem: Fix arithmetic in netem_dump() for 32-bit platforms	2022-06-17 20:29:38 -07:00
sch_pie.c	net: sched: fix misspellings using misspell-fixer tool	2020-11-10 17:00:28 -08:00
sch_plug.c	Revert "net: sched: Pass root lock to Qdisc_ops.enqueue"	2020-07-16 16:48:34 -07:00
sch_prio.c	net: sched: Remove Qdisc::running sequence counter	2021-10-18 12:54:41 +01:00
sch_qfq.c	sch_qfq: prevent shift-out-of-bounds in qfq_init_qdisc	2022-01-04 12:36:51 +00:00
sch_red.c	net: sched: validate stab values	2021-03-10 15:47:52 -08:00
sch_sfb.c	net/sched: store the last executed chain also for clsact egress	2021-07-29 22:17:37 +01:00
sch_sfq.c	net/sched: store the last executed chain also for clsact egress	2021-07-29 22:17:37 +01:00
sch_skbprio.c	Revert "net: sched: Pass root lock to Qdisc_ops.enqueue"	2020-07-16 16:48:34 -07:00
sch_taprio.c	time64.h: consolidate uses of PSEC_PER_NSEC	2022-06-30 21:18:16 -07:00
sch_tbf.c	net: sch_tbf: Add a graft command	2021-10-19 12:24:51 +01:00
sch_teql.c	net: sched: sch_teql: fix null-pointer dereference	2021-04-08 14:14:42 -07:00