linux/net/core
Patrick McHardy 68365458a4 [NET]: rtnl_link: fix use-after-free
When unregistering the rtnl_link_ops, all existing devices using
the ops are destroyed. With nested devices this may lead to a
use-after-free despite the use of for_each_netdev_safe() in case
the upper device is next in the device list and is destroyed
by the NETDEV_UNREGISTER notifier.

The easy fix is to restart scanning the device list after removing
a device. Alternatively we could add new devices to the front of
the list to avoid having dependant devices follow the device they
depend on. A third option would be to only restart scanning if
dev->iflink of the next device matches dev->ifindex of the current
one. For now this seems like the safest solution.

With this patch, the veth rtnl_link_ops unregistration can use
rtnl_link_unregister() directly since it now also handles destruction
of multiple devices at once.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
2008-01-20 20:31:45 -08:00
..
datagram.c
dev_mcast.c [NET]: Move unneeded data to initdata section. 2007-11-13 03:23:50 -08:00
dev.c [NET]: Stop polling when napi_disable() is pending. 2008-01-08 23:30:13 -08:00
dst.c [NET]: Removing duplicit #includes 2007-11-07 04:11:44 -08:00
ethtool.c
fib_rules.c [INET]: Small possible memory leak in FIB rules 2007-11-10 22:12:03 -08:00
filter.c
flow.c [NET]: Use BUILD_BUG_ON in net/core/flowi.c 2007-10-23 21:27:57 -07:00
gen_estimator.c remove asm/bitops.h includes 2007-10-19 11:53:41 -07:00
gen_stats.c
iovec.c
kmap_skb.h
link_watch.c
Makefile
neighbour.c [NEIGH]: Revert 'Fix race between neigh_parms_release and neightbl_fill_parms' 2008-01-20 20:31:42 -08:00
net_namespace.c [NET]: Cleanup pernet operation without CONFIG_NET_NS 2007-11-13 03:23:21 -08:00
net-sysfs.c [NET]: Remove in-code externs for some functions from net/core/dev.c 2007-10-23 21:27:56 -07:00
net-sysfs.h [NET]: Remove in-code externs for some functions from net/core/dev.c 2007-10-23 21:27:56 -07:00
netevent.c
netpoll.c [NET]: Fix race between poll_napi() and net_rx_action() 2007-10-29 22:37:28 -07:00
pktgen.c [PKTGEN]: Fix double unlock of xfrm_state->lock 2007-11-19 22:51:24 -08:00
request_sock.c [INET]: Fix potential kfree on vmalloc-ed area of request_sock_queue 2007-11-15 02:57:06 -08:00
rtnetlink.c [NET]: rtnl_link: fix use-after-free 2008-01-20 20:31:45 -08:00
scm.c [NET]: Fix function put_cmsg() which may cause usr application memory overflow 2007-12-20 14:36:44 -08:00
skbuff.c [NET]: Clone the sk_buff 'iif' field in __skb_clone() 2008-01-08 23:30:17 -08:00
sock.c [NET]: Unexport sysctl_{r,w}mem_max. 2007-11-12 21:24:14 -08:00
stream.c
sysctl_net_core.c [NET]: Don't declare extern variables in net/core/sysctl_net_core.c 2007-10-23 21:27:56 -07:00
user_dma.c
utils.c