2
0
mirror of https://github.com/edk2-porting/linux-next.git synced 2024-12-28 07:04:00 +08:00
linux-next/include/linux/netfilter
Vishwanath Pai 596cf3fe58 netfilter: ipset: fix race condition in ipset save, swap and delete
This fix adds a new reference counter (ref_netlink) for the struct ip_set.
The other reference counter (ref) can be swapped out by ip_set_swap and we
need a separate counter to keep track of references for netlink events
like dump. Using the same ref counter for dump causes a race condition
which can be demonstrated by the following script:

ipset create hash_ip1 hash:ip family inet hashsize 1024 maxelem 500000 \
counters
ipset create hash_ip2 hash:ip family inet hashsize 300000 maxelem 500000 \
counters
ipset create hash_ip3 hash:ip family inet hashsize 1024 maxelem 500000 \
counters

ipset save &

ipset swap hash_ip3 hash_ip2
ipset destroy hash_ip3 /* will crash the machine */

Swap will exchange the values of ref so destroy will see ref = 0 instead of
ref = 1. With this fix in place swap will not succeed because ipset save
still has ref_netlink on the set (ip_set_swap doesn't swap ref_netlink).

Both delete and swap will error out if ref_netlink != 0 on the set.

Note: The changes to *_head functions is because previously we would
increment ref whenever we called these functions, we don't do that
anymore.

Reviewed-by: Joshua Hunt <johunt@akamai.com>
Signed-off-by: Vishwanath Pai <vpai@akamai.com>
Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2016-03-28 17:57:45 +02:00
..
ipset netfilter: ipset: fix race condition in ipset save, swap and delete 2016-03-28 17:57:45 +02:00
nf_conntrack_amanda.h
nf_conntrack_common.h netfilter: Remove extern from function prototypes 2013-09-26 14:48:15 -07:00
nf_conntrack_dccp.h
nf_conntrack_ftp.h
nf_conntrack_h323_asn1.h
nf_conntrack_h323_types.h
nf_conntrack_h323.h netfilter: Remove extern from function prototypes 2013-09-26 14:48:15 -07:00
nf_conntrack_irc.h
nf_conntrack_pptp.h
nf_conntrack_proto_gre.h netfilter: nf_conntrack: flush net_gre->keymap_list only from gre helper 2014-04-08 10:56:12 +02:00
nf_conntrack_sane.h
nf_conntrack_sctp.h netfilter: nf_ct_sctp: move ip_ct_sctp away from UAPI 2015-11-23 17:54:42 +01:00
nf_conntrack_sip.h Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next 2013-10-04 13:26:38 -04:00
nf_conntrack_snmp.h
nf_conntrack_tcp.h
nf_conntrack_tftp.h
nf_conntrack_zones_common.h netfilter: nf_conntrack: make nf_ct_zone_dflt built-in 2015-09-02 16:32:56 -07:00
nfnetlink_acct.h netfilter: nfacct: per network namespace support 2015-08-07 11:50:56 +02:00
nfnetlink.h nfnetlink: remove nfnetlink_alloc_skb 2016-02-18 11:42:19 -05:00
x_tables.h netfilter: xtables: don't hook tables by default 2016-03-02 20:05:24 +01:00
xt_hashlimit.h
xt_physdev.h