Vishwanath Pai 596cf3fe58 netfilter: ipset: fix race condition in ipset save, swap and delete ... This fix adds a new reference counter (ref_netlink) for the struct ip_set. The other reference counter (ref) can be swapped out by ip_set_swap and we need a separate counter to keep track of references for netlink events like dump. Using the same ref counter for dump causes a race condition which can be demonstrated by the following script: ipset create hash_ip1 hash:ip family inet hashsize 1024 maxelem 500000 \ counters ipset create hash_ip2 hash:ip family inet hashsize 300000 maxelem 500000 \ counters ipset create hash_ip3 hash:ip family inet hashsize 1024 maxelem 500000 \ counters ipset save & ipset swap hash_ip3 hash_ip2 ipset destroy hash_ip3 /* will crash the machine */ Swap will exchange the values of ref so destroy will see ref = 0 instead of ref = 1. With this fix in place swap will not succeed because ipset save still has ref_netlink on the set (ip_set_swap doesn't swap ref_netlink). Both delete and swap will error out if ref_netlink != 0 on the set. Note: The changes to *_head functions is because previously we would increment ref whenever we called these functions, we don't do that anymore. Reviewed-by: Joshua Hunt <johunt@akamai.com> Signed-off-by: Vishwanath Pai <vpai@akamai.com> Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>		2016-03-28 17:57:45 +02:00
..
ipset	netfilter: ipset: fix race condition in ipset save, swap and delete	2016-03-28 17:57:45 +02:00
nf_conntrack_amanda.h
nf_conntrack_common.h	netfilter: Remove extern from function prototypes	2013-09-26 14:48:15 -07:00
nf_conntrack_dccp.h
nf_conntrack_ftp.h
nf_conntrack_h323_asn1.h
nf_conntrack_h323_types.h
nf_conntrack_h323.h	netfilter: Remove extern from function prototypes	2013-09-26 14:48:15 -07:00
nf_conntrack_irc.h
nf_conntrack_pptp.h
nf_conntrack_proto_gre.h	netfilter: nf_conntrack: flush net_gre->keymap_list only from gre helper	2014-04-08 10:56:12 +02:00
nf_conntrack_sane.h
nf_conntrack_sctp.h	netfilter: nf_ct_sctp: move ip_ct_sctp away from UAPI	2015-11-23 17:54:42 +01:00
nf_conntrack_sip.h	Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next	2013-10-04 13:26:38 -04:00
nf_conntrack_snmp.h
nf_conntrack_tcp.h
nf_conntrack_tftp.h
nf_conntrack_zones_common.h	netfilter: nf_conntrack: make nf_ct_zone_dflt built-in	2015-09-02 16:32:56 -07:00
nfnetlink_acct.h	netfilter: nfacct: per network namespace support	2015-08-07 11:50:56 +02:00
nfnetlink.h	nfnetlink: remove nfnetlink_alloc_skb	2016-02-18 11:42:19 -05:00
x_tables.h	netfilter: xtables: don't hook tables by default	2016-03-02 20:05:24 +01:00
xt_hashlimit.h
xt_physdev.h