linux/drivers/net
Mikulas Patocka b09e786bd1 tun: fix a crash bug and a memory leak
This patch fixes a crash
tun_chr_close -> netdev_run_todo -> tun_free_netdev -> sk_release_kernel ->
sock_release -> iput(SOCK_INODE(sock))
introduced by commit 1ab5ecb90c

The problem is that this socket is embedded in struct tun_struct, it has
no inode, iput is called on invalid inode, which modifies invalid memory
and optionally causes a crash.

sock_release also decrements sockets_in_use, this causes a bug that
"sockets: used" field in /proc/*/net/sockstat keeps on decreasing when
creating and closing tun devices.

This patch introduces a flag SOCK_EXTERNALLY_ALLOCATED that instructs
sock_release to not free the inode and not decrement sockets_in_use,
fixing both memory corruption and sockets_in_use underflow.

It should be backported to 3.3 an 3.4 stabke.

Signed-off-by: Mikulas Patocka <mikulas@artax.karlin.mff.cuni.cz>
Cc: stable@kernel.org
Signed-off-by: David S. Miller <davem@davemloft.net>
2012-07-20 11:21:06 -07:00
..
appletalk
arcnet
bonding bond_sysfs: use real_num_tx_queues rather than params.tx_queue 2012-07-20 11:07:00 -07:00
caif caif-hsi: Fix merge issues. 2012-06-29 00:46:53 -07:00
can can: janz-ican3: add support for one shot mode 2012-07-20 17:49:05 +02:00
cris net: Properly define functions with no parameters 2012-07-10 23:13:45 -07:00
dsa
ethernet Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/jkirsher/net-next 2012-07-20 11:11:59 -07:00
fddi
hamradio
hippi
hyperv hyperv: Add support for setting MAC from within guests 2012-07-16 22:54:24 -07:00
irda
phy Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2012-07-10 23:56:33 -07:00
plip
ppp
slip
team team: add multiqueue support 2012-07-20 11:07:00 -07:00
usb asix: AX88172A driver depends on phylib 2012-07-19 10:48:07 -07:00
vmxnet3
wan
wimax drivers/net: Use eth_random_addr 2012-07-16 22:38:28 -07:00
wireless Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-next into for-davem 2012-07-20 12:30:48 -04:00
xen-netback xen/netback: only non-freed SKB is queued into tx_queue 2012-06-29 00:50:20 -07:00
dummy.c dummy: use IFF_LIVE_ADDR_CHANGE priv_flag 2012-06-30 01:08:00 -07:00
eql.c
ifb.c
Kconfig
LICENSE.SRC
loopback.c
macvlan.c
macvtap.c
Makefile
mdio.c
mii.c
netconsole.c
rionet.c
sb1000.c
Space.c
sungem_phy.c
tun.c tun: fix a crash bug and a memory leak 2012-07-20 11:21:06 -07:00
veth.c
virtio_net.c virtio_net: use IFF_LIVE_ADDR_CHANGE priv_flag 2012-06-30 01:08:00 -07:00
xen-netfront.c xen/netfront: teardown the device before unregistering it. 2012-06-27 01:25:41 -07:00