Thomas Graf c58dd2dd44 netfilter: Can't fail and free after table replacement ... All xtables variants suffer from the defect that the copy_to_user() to copy the counters to user memory may fail after the table has already been exchanged and thus exposed. Return an error at this point will result in freeing the already exposed table. Any subsequent packet processing will result in a kernel panic. We can't copy the counters before exposing the new tables as we want provide the counter state after the old table has been unhooked. Therefore convert this into a silent error. Cc: Florian Westphal <fw@strlen.de> Signed-off-by: Thomas Graf <tgraf@suug.ch> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>		2014-04-05 17:46:22 +02:00
..
ip6_tables.c	netfilter: Can't fail and free after table replacement	2014-04-05 17:46:22 +02:00
ip6t_ah.c	netfilter: ip6_tables: add flags parameter to ipv6_find_hdr()	2012-05-09 12:53:47 +02:00
ip6t_eui64.c	netfilter: xtables: change hotdrop pointer to direct modification	2010-05-11 18:35:27 +02:00
ip6t_frag.c	netfilter: ip6_tables: add flags parameter to ipv6_find_hdr()	2012-05-09 12:53:47 +02:00
ip6t_hbh.c	netfilter: ip6_tables: add flags parameter to ipv6_find_hdr()	2012-05-09 12:53:47 +02:00
ip6t_ipv6header.c	netfilter: xtables: deconstify struct xt_action_param for matches	2010-05-11 18:33:37 +02:00
ip6t_MASQUERADE.c	netfilter: nf_conntrack: don't send destroy events from iterator	2013-08-09 12:03:33 +02:00
ip6t_mh.c	netfilter: xtables: change hotdrop pointer to direct modification	2010-05-11 18:35:27 +02:00
ip6t_NPT.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2013-04-07 18:37:01 -04:00
ip6t_REJECT.c	netfilter: REJECT: separate reusable code	2013-12-30 15:04:41 +01:00
ip6t_rpfilter.c	netfilter: xt_rpfilter: skip locally generated broadcast/multicast, too	2013-04-19 00:11:59 +02:00
ip6t_rt.c	netfilter: ip6_tables: add flags parameter to ipv6_find_hdr()	2012-05-09 12:53:47 +02:00
ip6t_SYNPROXY.c	netfilter: SYNPROXY target: restrict to INPUT/FORWARD	2013-12-11 11:30:25 +01:00
ip6table_filter.c	netfilter: pass hook ops to hookfn	2013-10-14 11:29:31 +02:00
ip6table_mangle.c	netfilter: pass hook ops to hookfn	2013-10-14 11:29:31 +02:00
ip6table_nat.c	netfilter: pass hook ops to hookfn	2013-10-14 11:29:31 +02:00
ip6table_raw.c	netfilter: pass hook ops to hookfn	2013-10-14 11:29:31 +02:00
ip6table_security.c	netfilter: pass hook ops to hookfn	2013-10-14 11:29:31 +02:00
Kconfig	netfilter: nft_reject: split up reject module into IPv4 and IPv6 specifc parts	2014-02-06 09:44:10 +01:00
Makefile	netfilter: nft_reject: split up reject module into IPv4 and IPv6 specifc parts	2014-02-06 09:44:10 +01:00
nf_conntrack_l3proto_ipv6.c	netfilter: push reasm skb through instead of original frag skbs	2013-11-11 00:19:35 -05:00
nf_conntrack_proto_icmpv6.c	netfilter: nf_log: prepare net namespace support for loggers	2013-04-05 20:12:54 +02:00
nf_conntrack_reasm.c	netfilter: push reasm skb through instead of original frag skbs	2013-11-11 00:19:35 -05:00
nf_defrag_ipv6_hooks.c	netfilter: push reasm skb through instead of original frag skbs	2013-11-11 00:19:35 -05:00
nf_nat_l3proto_ipv6.c	netfilter: ipv6: using csum_ipv6_magic requires net/ip6_checksum.h	2012-09-05 17:46:06 -04:00
nf_nat_proto_icmpv6.c	netfilter: nf_nat_proto_icmpv6:: fix wrong comparison in icmpv6_manip_pkt	2013-09-13 11:58:48 +02:00
nf_tables_ipv6.c	netfilter: nf_tables: fix error path in the init functions	2014-01-09 23:25:48 +01:00
nft_chain_nat_ipv6.c	netfilter: nf_tables: rename nft_do_chain_pktinfo() to nft_do_chain()	2014-01-09 20:17:16 +01:00
nft_chain_route_ipv6.c	netfilter: nf_tables: rename nft_do_chain_pktinfo() to nft_do_chain()	2014-01-09 20:17:16 +01:00
nft_reject_ipv6.c	netfilter: nf_tables: add reject module for NFPROTO_INET	2014-02-06 09:44:18 +01:00