2
0
mirror of https://github.com/edk2-porting/linux-next.git synced 2024-12-23 12:43:55 +08:00
linux-next/include
Vishwanath Pai 596cf3fe58 netfilter: ipset: fix race condition in ipset save, swap and delete
This fix adds a new reference counter (ref_netlink) for the struct ip_set.
The other reference counter (ref) can be swapped out by ip_set_swap and we
need a separate counter to keep track of references for netlink events
like dump. Using the same ref counter for dump causes a race condition
which can be demonstrated by the following script:

ipset create hash_ip1 hash:ip family inet hashsize 1024 maxelem 500000 \
counters
ipset create hash_ip2 hash:ip family inet hashsize 300000 maxelem 500000 \
counters
ipset create hash_ip3 hash:ip family inet hashsize 1024 maxelem 500000 \
counters

ipset save &

ipset swap hash_ip3 hash_ip2
ipset destroy hash_ip3 /* will crash the machine */

Swap will exchange the values of ref so destroy will see ref = 0 instead of
ref = 1. With this fix in place swap will not succeed because ipset save
still has ref_netlink on the set (ip_set_swap doesn't swap ref_netlink).

Both delete and swap will error out if ref_netlink != 0 on the set.

Note: The changes to *_head functions is because previously we would
increment ref whenever we called these functions, we don't do that
anymore.

Reviewed-by: Joshua Hunt <johunt@akamai.com>
Signed-off-by: Vishwanath Pai <vpai@akamai.com>
Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2016-03-28 17:57:45 +02:00
..
acpi Merge branches 'acpi-processor' and 'acpi-cppc' 2016-03-14 14:20:33 +01:00
asm-generic Merge branch 'locking-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 2016-03-24 09:36:18 -07:00
clocksource
crypto Merge branch 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security 2016-03-17 11:33:45 -07:00
drm Merge branch 'drm-next' of git://people.freedesktop.org/~airlied/linux 2016-03-21 13:48:00 -07:00
dt-bindings The clk changes for this release cycle are mostly dominated by 2016-03-23 06:06:45 -07:00
keys
kvm arm64: KVM: vgic-v3: Avoid accessing ICH registers 2016-03-09 04:24:04 +00:00
linux netfilter: ipset: fix race condition in ipset save, swap and delete 2016-03-28 17:57:45 +02:00
math-emu
media Merge branch 'for-linus' of git://ftp.arm.linux.org.uk/~rmk/linux-arm 2016-03-19 16:31:54 -07:00
memory
misc cxl: Remove cxl_get_phys_dev() kernel API 2016-03-09 23:40:02 +11:00
net net: ping: make ping_v6_sendmsg static 2016-03-23 22:09:58 -04:00
pcmcia
ras
rdma Round two of 4.6 merge window patches 2016-03-22 15:48:44 -07:00
rxrpc rxrpc: Be more selective about the types of received packets we accept 2016-03-04 15:56:06 +00:00
scsi Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 2016-03-17 11:22:54 -07:00
soc IOMMU Updates for Linux v4.6 2016-03-22 11:57:43 -07:00
sound ASoC: Updates for v4.6 2016-03-14 14:03:29 +01:00
target Merge branch 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending 2016-03-22 12:41:14 -07:00
trace Nothing major this round. Mostly small clean ups and fixes. 2016-03-24 10:52:25 -07:00
uapi Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2016-03-23 23:25:14 -07:00
video drm/omap: add dispc_channel_connected field to omap_dss_device 2016-03-03 17:38:22 +02:00
xen xen-netback: re-import canonical netif header 2016-03-13 22:08:01 -04:00
Kbuild