Cong Wang 3d210534cc net_sched: fix a race condition in tcindex_destroy() ... (cherry picked from commit 8015d93ebd) tcindex_destroy() invokes tcindex_destroy_element() via a walker to delete each filter result in its perfect hash table, and tcindex_destroy_element() calls tcindex_delete() which schedules tcf RCU works to do the final deletion work. Unfortunately this races with the RCU callback __tcindex_destroy(), which could lead to use-after-free as reported by Adrian. Fix this by migrating this RCU callback to tcf RCU work too, as that workqueue is ordered, we will not have use-after-free. Note, we don't need to hold netns refcnt because we don't call tcf_exts_destroy() here. Fixes: 27ce4f05e2 ("net_sched: use tcf_queue_work() in tcindex filter") Reported-by: Adrian <bugs@abtelecom.ro> Cc: Ben Hutchings <ben@decadent.org.uk> Cc: Jamal Hadi Salim <jhs@mojatatu.com> Cc: Jiri Pirko <jiri@resnulli.us> Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>		2019-02-20 20:11:10 -08:00
..
6lowpan	6lowpan: convert to DEFINE_SHOW_ATTRIBUTE	2018-12-19 00:28:05 +01:00
9p	9p/net: put a lower bound on msize	2018-12-25 17:07:49 +09:00
802
8021q	net: core: dev: Add extack argument to dev_change_flags()	2018-12-06 13:26:07 -08:00
appletalk
atm	atm: clean up vcc_seq_next()	2019-02-16 18:12:22 -08:00
ax25	ax25: fix possible use-after-free	2019-01-23 11:18:00 -08:00
batman-adv	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2019-02-15 12:38:38 -08:00
bluetooth	socket: Use old_timeval types for socket timestamps	2019-02-03 11:17:30 -08:00
bpf	bpf: add BPF_PROG_TEST_RUN support for flow dissector	2019-01-29 01:08:29 +01:00
bpfilter	bpfilter: remove extra header search paths for bpfilter_umh	2019-02-03 20:11:43 -08:00
bridge	Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next	2019-02-18 11:38:30 -08:00
caif	net: caif: use skb helpers instead of open-coding them	2019-02-17 11:01:17 -08:00
can	can: bcm: check timer values before ktime conversion	2019-01-22 11:33:46 +01:00
ceph	libceph: avoid KEEPALIVE_PENDING races in ceph_con_keepalive()	2019-01-21 14:53:12 +01:00
core	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2019-02-20 00:34:07 -08:00
dcb
dccp	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2019-02-08 15:00:17 -08:00
decnet	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2019-01-29 21:18:54 -08:00
dns_resolver
dsa	net: dsa: Implement flow_dissect callback for tag_dsa.	2019-02-18 16:35:41 -08:00
ethernet	net: ethernet: provide nvmem_get_mac_address()	2018-12-03 15:40:30 -08:00
hsr
ieee802154	6lowpan: use rbtree for IP frag queue	2019-02-19 10:38:01 +01:00
ife
ipv4	gso: validate gso_type on ipip style tunnels	2019-02-20 11:24:27 -08:00
ipv6	gso: validate gso_type on ipip style tunnels	2019-02-20 11:24:27 -08:00
iucv	iucv: Remove SKB list assumptions.	2018-11-10 16:55:11 -08:00
kcm
key	af_key: fix indentation on declaration statement	2018-11-15 18:09:32 +01:00
l2tp	l2tp: copy 4 more bytes to linear part if necessary	2019-01-31 08:58:46 -08:00
l3mdev	l3mdev: add function to retreive upper master	2018-12-03 14:15:26 -08:00
lapb
llc	llc: do not use sk_eat_skb()	2018-10-22 19:59:20 -07:00
mac80211	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2019-02-20 00:34:07 -08:00
mac802154
mpls	mpls_iptunnel: use struct_size() helper	2019-02-08 22:57:27 -08:00
ncsi	net/ncsi: Add NCSI Mellanox OEM command	2018-11-27 16:37:20 -08:00
netfilter	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2019-02-20 00:34:07 -08:00
netlabel
netlink	net: netlink: add helper to retrieve NETLINK_F_STRICT_CHK	2019-01-19 10:09:58 -08:00
netrom	netrom: switch to sock timer API	2019-01-27 10:38:04 -08:00
nfc	net: Revert recent Spectre-v1 patches.	2018-12-23 16:01:35 -08:00
nsh
openvswitch	Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next	2019-01-28 17:34:38 -08:00
packet	net/packet: fix 4gb buffer limit due to overflow check	2019-02-12 13:37:23 -05:00
phonet	net: Revert recent Spectre-v1 patches.	2018-12-23 16:01:35 -08:00
psample
qrtr
rds	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2019-02-08 15:00:17 -08:00
rfkill	rfkill: gpio: Remove unused include	2018-12-18 13:13:56 +01:00
rose	net: rose: add missing dev_put() on error in rose_bind	2019-02-19 13:22:46 -08:00
rxrpc	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2019-02-08 15:00:17 -08:00
sched	net_sched: fix a race condition in tcindex_destroy()	2019-02-20 20:11:10 -08:00
sctp	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2019-02-15 12:38:38 -08:00
smc	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2019-02-15 12:38:38 -08:00
strparser	bpf, sockmap: convert to generic sk_msg interface	2018-10-15 12:23:19 -07:00
sunrpc	Two small fixes, one for crashes using nfs/krb5 with older enctypes, one	2019-02-16 17:38:01 -08:00
switchdev	net: Get rid of SWITCHDEV_ATTR_ID_PORT_PARENT_ID	2019-02-06 14:17:03 -08:00
tipc	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2019-02-15 12:38:38 -08:00
tls	net/tls: Move protocol constants from cipher context to tls context	2019-02-19 10:40:36 -08:00
unix	Revert "net: simplify sock_poll_wait"	2018-10-23 10:57:06 -07:00
vmw_vsock	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2019-02-15 12:38:38 -08:00
wimax
wireless	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2019-02-15 12:38:38 -08:00
x25	net/x25: do not hold the cpu too long in x25_new_lci()	2019-02-11 13:20:14 -08:00
xdp	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2019-02-20 00:34:07 -08:00
xfrm	xfrm: Make set-mark default behavior backward compatible	2019-01-16 13:10:55 +01:00
compat.c	socket: Use old_timeval types for socket timestamps	2019-02-03 11:17:30 -08:00
Kconfig	bpf: make LWTUNNEL_BPF dependent on INET	2019-02-16 01:06:30 +01:00
Makefile
socket.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2019-02-08 15:00:17 -08:00
sysctl_net.c