linux/net/core
Patrick McHardy 68365458a4 [NET]: rtnl_link: fix use-after-free
When unregistering the rtnl_link_ops, all existing devices using
the ops are destroyed. With nested devices this may lead to a
use-after-free despite the use of for_each_netdev_safe() in case
the upper device is next in the device list and is destroyed
by the NETDEV_UNREGISTER notifier.

The easy fix is to restart scanning the device list after removing
a device. Alternatively we could add new devices to the front of
the list to avoid having dependant devices follow the device they
depend on. A third option would be to only restart scanning if
dev->iflink of the next device matches dev->ifindex of the current
one. For now this seems like the safest solution.

With this patch, the veth rtnl_link_ops unregistration can use
rtnl_link_unregister() directly since it now also handles destruction
of multiple devices at once.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
2008-01-20 20:31:45 -08:00
..
datagram.c [NET]: Do not dereference iov if length is zero 2007-09-11 10:29:07 +02:00
dev_mcast.c [NET]: Move unneeded data to initdata section. 2007-11-13 03:23:50 -08:00
dev.c [NET]: Stop polling when napi_disable() is pending. 2008-01-08 23:30:13 -08:00
dst.c [NET]: Removing duplicit #includes 2007-11-07 04:11:44 -08:00
ethtool.c [ETHTOOL] Provide default behaviors for a few ethtool sub-ioctls 2007-10-10 16:51:17 -07:00
fib_rules.c [INET]: Small possible memory leak in FIB rules 2007-11-10 22:12:03 -08:00
filter.c [NET]: Fix bug in sk_filter race cures. 2007-10-18 21:48:39 -07:00
flow.c [NET]: Use BUILD_BUG_ON in net/core/flowi.c 2007-10-23 21:27:57 -07:00
gen_estimator.c remove asm/bitops.h includes 2007-10-19 11:53:41 -07:00
gen_stats.c [SK_BUFF]: Convert skb->tail to sk_buff_data_t 2007-04-25 22:26:28 -07:00
iovec.c [PATCH] remove many unneeded #includes of sched.h 2007-02-14 08:09:54 -08:00
kmap_skb.h [PATCH] severing skbuff.h -> highmem.h 2006-12-04 02:00:29 -05:00
link_watch.c [NET] link_watch: Always schedule urgent events 2007-05-10 23:45:28 -07:00
Makefile [NET]: Fix running without sysfs 2007-10-10 16:52:46 -07:00
neighbour.c [NEIGH]: Revert 'Fix race between neigh_parms_release and neightbl_fill_parms' 2008-01-20 20:31:42 -08:00
net_namespace.c [NET]: Cleanup pernet operation without CONFIG_NET_NS 2007-11-13 03:23:21 -08:00
net-sysfs.c [NET]: Remove in-code externs for some functions from net/core/dev.c 2007-10-23 21:27:56 -07:00
net-sysfs.h [NET]: Remove in-code externs for some functions from net/core/dev.c 2007-10-23 21:27:56 -07:00
netevent.c [NET]: net/core/netevent.c should #include <net/netevent.h> 2007-07-05 17:40:27 -07:00
netpoll.c [NET]: Fix race between poll_napi() and net_rx_action() 2007-10-29 22:37:28 -07:00
pktgen.c [PKTGEN]: Fix double unlock of xfrm_state->lock 2007-11-19 22:51:24 -08:00
request_sock.c [INET]: Fix potential kfree on vmalloc-ed area of request_sock_queue 2007-11-15 02:57:06 -08:00
rtnetlink.c [NET]: rtnl_link: fix use-after-free 2008-01-20 20:31:45 -08:00
scm.c [NET]: Fix function put_cmsg() which may cause usr application memory overflow 2007-12-20 14:36:44 -08:00
skbuff.c [NET]: Clone the sk_buff 'iif' field in __skb_clone() 2008-01-08 23:30:17 -08:00
sock.c [NET]: Unexport sysctl_{r,w}mem_max. 2007-11-12 21:24:14 -08:00
stream.c [NET] CORE: Fix whitespace errors. 2007-02-10 23:19:25 -08:00
sysctl_net_core.c [NET]: Don't declare extern variables in net/core/sysctl_net_core.c 2007-10-23 21:27:56 -07:00
user_dma.c [NET]: Revert sk_buff walker cleanups. 2007-04-27 15:21:23 -07:00
utils.c [NET] net/core/utils: fix sparse warning 2007-08-07 18:02:43 -07:00