Jiri Pirko 255cd50f20 net: sched: fix use-after-free in tcf_action_destroy and tcf_del_walker ... Recent commit d7fb60b9ca ("net_sched: get rid of tcfa_rcu") removed freeing in call_rcu, which changed already existing hard-to-hit race condition into 100% hit: [ 598.599825] BUG: unable to handle kernel NULL pointer dereference at 0000000000000030 [ 598.607782] IP: tcf_action_destroy+0xc0/0x140 Or: [ 40.858924] BUG: unable to handle kernel NULL pointer dereference at 0000000000000030 [ 40.862840] IP: tcf_generic_walker+0x534/0x820 Fix this by storing the ops and use them directly for module_put call. Fixes: a85a970af2 ("net_sched: move tc_action into tcf_common") Signed-off-by: Jiri Pirko <jiri@mellanox.com> Signed-off-by: David S. Miller <davem@davemloft.net>		2017-09-13 09:34:08 -07:00
..
Kconfig	…
Makefile	…
act_api.c	net: sched: fix use-after-free in tcf_action_destroy and tcf_del_walker	2017-09-13 09:34:08 -07:00
act_bpf.c	net/sched: Change act_api and act_xxx modules to use IDR	2017-08-30 14:38:51 -07:00
act_connmark.c	net/sched: Change act_api and act_xxx modules to use IDR	2017-08-30 14:38:51 -07:00
act_csum.c	net/sched: Change act_api and act_xxx modules to use IDR	2017-08-30 14:38:51 -07:00
act_gact.c	net/sched: Change act_api and act_xxx modules to use IDR	2017-08-30 14:38:51 -07:00
act_ife.c	net/sched: Change act_api and act_xxx modules to use IDR	2017-08-30 14:38:51 -07:00
act_ipt.c	net/sched: Change act_api and act_xxx modules to use IDR	2017-08-30 14:38:51 -07:00
act_meta_mark.c	…
act_meta_skbprio.c	…
act_meta_skbtcindex.c	…
act_mirred.c	net/sched: Change act_api and act_xxx modules to use IDR	2017-08-30 14:38:51 -07:00
act_nat.c	net/sched: Change act_api and act_xxx modules to use IDR	2017-08-30 14:38:51 -07:00
act_pedit.c	net/sched: Change act_api and act_xxx modules to use IDR	2017-08-30 14:38:51 -07:00
act_police.c	net/sched: Change act_api and act_xxx modules to use IDR	2017-08-30 14:38:51 -07:00
act_sample.c	net/sched: Change act_api and act_xxx modules to use IDR	2017-08-30 14:38:51 -07:00
act_simple.c	net/sched: Change act_api and act_xxx modules to use IDR	2017-08-30 14:38:51 -07:00
act_skbedit.c	net/sched: Change act_api and act_xxx modules to use IDR	2017-08-30 14:38:51 -07:00
act_skbmod.c	net/sched: Change act_api and act_xxx modules to use IDR	2017-08-30 14:38:51 -07:00
act_tunnel_key.c	net/sched: Change act_api and act_xxx modules to use IDR	2017-08-30 14:38:51 -07:00
act_vlan.c	net/sched: Change act_api and act_xxx modules to use IDR	2017-08-30 14:38:51 -07:00
cls_api.c	net_sched: carefully handle tcf_block_put()	2017-09-12 20:41:02 -07:00
cls_basic.c	net_sched: add reverse binding for tc class	2017-08-31 11:40:52 -07:00
cls_bpf.c	net_sched: add reverse binding for tc class	2017-08-31 11:40:52 -07:00
cls_cgroup.c	…
cls_flow.c	…
cls_flower.c	net_sched: add reverse binding for tc class	2017-08-31 11:40:52 -07:00
cls_fw.c	net_sched: add reverse binding for tc class	2017-08-31 11:40:52 -07:00
cls_matchall.c	net_sched: add reverse binding for tc class	2017-08-31 11:40:52 -07:00
cls_route.c	net_sched: add reverse binding for tc class	2017-08-31 11:40:52 -07:00
cls_rsvp.c	…
cls_rsvp.h	net/sched: fix pointer check in gen_handle	2017-09-11 14:34:52 -07:00
cls_rsvp6.c	…
cls_tcindex.c	net_sched: add reverse binding for tc class	2017-08-31 11:40:52 -07:00
cls_u32.c	net_sched: add reverse binding for tc class	2017-08-31 11:40:52 -07:00
em_canid.c	…
em_cmp.c	…
em_ipset.c	…
em_meta.c	…
em_nbyte.c	…
em_text.c	…
em_u32.c	…
ematch.c	…
sch_api.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2017-09-01 17:42:05 -07:00
sch_atm.c	net_sched: remove tc class reference counting	2017-08-25 17:19:10 -07:00
sch_blackhole.c	…
sch_cbq.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2017-09-01 17:42:05 -07:00
sch_choke.c	…
sch_codel.c	…
sch_drr.c	net_sched: remove tc class reference counting	2017-08-25 17:19:10 -07:00
sch_dsmark.c	net_sched: remove tc class reference counting	2017-08-25 17:19:10 -07:00
sch_fifo.c	…
sch_fq.c	…
sch_fq_codel.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2017-09-01 17:42:05 -07:00
sch_generic.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2017-09-01 17:42:05 -07:00
sch_gred.c	…
sch_hfsc.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2017-09-01 17:42:05 -07:00
sch_hhf.c	sch_hhf: fix null pointer dereference on init failure	2017-08-30 15:26:11 -07:00
sch_htb.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2017-09-01 17:42:05 -07:00
sch_ingress.c	net_sched: remove tc class reference counting	2017-08-25 17:19:10 -07:00
sch_mq.c	net_sched: remove tc class reference counting	2017-08-25 17:19:10 -07:00
sch_mqprio.c	net_sched: remove tc class reference counting	2017-08-25 17:19:10 -07:00
sch_multiq.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2017-09-01 17:42:05 -07:00
sch_netem.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2017-09-01 17:42:05 -07:00
sch_pie.c	…
sch_plug.c	…
sch_prio.c	sched: Use __qdisc_drop instead of kfree_skb in sch_prio and sch_qfq	2017-09-06 21:20:07 -07:00
sch_qfq.c	sched: Use __qdisc_drop instead of kfree_skb in sch_prio and sch_qfq	2017-09-06 21:20:07 -07:00
sch_red.c	net_sched: remove tc class reference counting	2017-08-25 17:19:10 -07:00
sch_sfb.c	net_sched: remove tc class reference counting	2017-08-25 17:19:10 -07:00
sch_sfq.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2017-09-01 17:42:05 -07:00
sch_tbf.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2017-09-01 17:42:05 -07:00
sch_teql.c	…