Eric Dumazet 8ae8a9f21e inet: frags: call inet_frags_fini() after unregister_pernet_subsys() ...

[ Upstream commit ae7352d384 ]

Both IPv6 and 6lowpan are calling inet_frags_fini() too soon.

inet_frags_fini() is dismantling a kmem_cache, that might be needed
later when unregister_pernet_subsys() eventually has to remove
frags queues from hash tables and free them.

This fixes potential use-after-free, and is a prereq for the following patch.

Fixes: d4ad4d22e7 ("inet: frags: use kmem_cache for inet_frag_queue")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>

2020-01-29 10:24:25 +01:00

..

ila

ila_xlat: add missing hash secret initialization

2017-06-24 07:11:12 +02:00

netfilter

netfilter: ipv6: nf_defrag: accept duplicate fragments again

2019-07-21 09:05:53 +02:00

addrconf_core.c

…

addrconf.c

ipv6: Handle missing host route in __ipv6_ifa_notify

2019-10-07 18:53:24 +02:00

addrlabel.c

ipv6/addrlabel: fix ip6addrlbl_get()

2015-12-22 15:57:54 -05:00

af_inet6.c

ipv6: Consider sk_bound_dev_if when binding a socket to an address

2019-02-06 17:33:26 +01:00

ah6.c

ipsec: check return value of skb_to_sgvec always

2018-04-13 19:48:31 +02:00

anycast.c

…

calipso.c

ipv6: make ipv6_renew_options() interrupt/kernel safe

2018-08-24 13:12:36 +02:00

datagram.c

ip: on queued skb use skb_header_pointer instead of pskb_may_pull

2019-01-23 08:10:54 +01:00

esp6.c

ipsec: check return value of skb_to_sgvec always

2018-04-13 19:48:31 +02:00

exthdrs_core.c

ipv6: constify the skb pointer of ipv6_find_tlv().

2016-06-27 15:06:15 -04:00

exthdrs_offload.c

…

exthdrs.c

ipv6: make ipv6_renew_options() interrupt/kernel safe

2018-08-24 13:12:36 +02:00

fib6_rules.c

ipv6: Do not leak throw route references

2017-07-05 14:40:16 +02:00

fou6.c

fou: add Kconfig options for IPv6 support

2016-05-29 22:24:21 -07:00

icmp.c

net: handle no dst on skb in icmp6_send

2016-11-28 16:13:01 -05:00

inet6_connection_sock.c

tcp: don't annotate mark on control socket from tcp_v6_send_response()

2017-02-18 15:11:44 +01:00

inet6_hashtables.c

tcp/dccp: fix possible race __inet_lookup_established()

2020-01-04 13:41:12 +01:00

ip6_checksum.c

net: udp: fix handling of CHECKSUM_COMPLETE packets

2018-11-10 07:42:58 -08:00

ip6_fib.c

ipv6: fix typo in fib6_net_exit()

2017-09-20 08:19:56 +02:00

ip6_flowlabel.c

ipv6: flowlabel: fl6_sock_lookup() must use atomic_inc_not_zero

2019-06-22 08:17:21 +02:00

ip6_gre.c

ip6_gre: better validate user provided tunnel names

2018-04-13 19:48:35 +02:00

ip6_icmp.c

ipv6: icmp: add a force_saddr param to icmp6_send()

2016-06-18 22:11:38 -07:00

ip6_input.c

ipv6: drop incoming packets having a v4mapped source address

2019-10-07 18:53:20 +02:00

ip6_offload.c

gso_segment: Reset skb->mac_len after modifying network header

2018-09-29 03:07:32 -07:00

ip6_offload.h

udp: Add GRO functions to UDP socket

2016-04-07 16:53:29 -04:00

ip6_output.c

ipv6: Fix dangling pointer when ipv6 fragment

2019-04-17 08:36:44 +02:00

ip6_tunnel.c

ip6_tunnel: fix possible use-after-free on xmit

2019-08-11 12:22:17 +02:00

ip6_udp_tunnel.c

ipv6: explicitly initialize udp6_addr in udp_sock_create6()

2019-01-09 16:16:40 +01:00

ip6_vti.c

ipv6: tunnels: fix two use-after-free

2019-01-09 16:16:40 +01:00

ip6mr.c

ipv6: check sk sk_type and protocol early in ip_mroute_set/getsockopt

2019-08-04 09:33:43 +02:00

ipcomp6.c

…

ipv6_sockglue.c

ipv6: make ipv6_renew_options() interrupt/kernel safe

2018-08-24 13:12:36 +02:00

Kconfig

fou: fix IPv6 Kconfig options

2016-05-31 14:07:49 -07:00

Makefile

Merge branch 'stable-4.8' of git://git.infradead.org/users/pcmoore/selinux into next

2016-07-07 10:15:34 +10:00

mcast_snoop.c

…

mcast.c

mld: fix memory leak in mld_del_delrec()

2019-09-10 10:31:04 +01:00

mip6.c

…

ndisc.c

ipv6/ndisc: Preserve IPv6 control buffer if protocol error handlers are called

2018-11-10 07:42:57 -08:00

netfilter.c

…

output_core.c

inet: switch IP ID generator to siphash

2019-08-25 10:51:42 +02:00

ping.c

ipv6: Fix the link time qualifier of 'ping_v6_proc_exit_net()'

2019-09-21 07:14:01 +02:00

proc.c

inet: frags: break the 2GB limit for frags storage

2018-10-18 09:13:24 +02:00

protocol.c

…

raw.c

ipv6: use READ_ONCE() for inet->hdrincl as in ipv4

2019-06-11 12:22:47 +02:00

reassembly.c

inet: frags: call inet_frags_fini() after unregister_pernet_subsys()

2020-01-29 10:24:25 +01:00

route.c

net: Set rtm_table to RT_TABLE_COMPAT for ipv6 for tables > 255

2019-03-19 13:14:09 +01:00

sit.c

Revert "net: sit: fix memory leak in sit_init_net()"

2019-10-29 09:15:26 +01:00

syncookies.c

ipv4: ipv6: initialize treq->txhash in cookie_v[46]_check()

2017-08-11 08:49:32 -07:00

sysctl_net_ipv6.c

calipso: Add a label cache.

2016-06-27 15:06:17 -04:00

tcp_ipv6.c

tcp: do not use ipv6 header for ipv4 flow

2019-04-03 06:24:15 +02:00

tcpv6_offload.c

gso: validate gso_type in GSO handlers

2018-01-31 12:55:55 +01:00

tunnel6.c

ipv6: fix tunnel error handling

2015-11-03 10:52:13 -05:00

udp_impl.h

udplite: call proper backlog handlers

2016-11-24 15:32:14 -05:00

udp_offload.c

gso: validate gso_type in GSO handlers

2018-01-31 12:55:55 +01:00

udp.c

bpf: udp: ipv6: Avoid running reuseport's bpf_prog from __udp6_lib_err

2019-07-10 09:55:42 +02:00

udplite.c

udplite: call proper backlog handlers

2016-11-24 15:32:14 -05:00

xfrm6_input.c

vti6: fix input path

2016-09-21 10:09:14 +02:00

xfrm6_mode_beet.c

…

xfrm6_mode_ro.c

ipv6: xfrm: Handle errors reported by xfrm6_find_1stfragopt()

2017-06-14 15:05:51 +02:00

xfrm6_mode_transport.c

ipv6: xfrm: Handle errors reported by xfrm6_find_1stfragopt()

2017-06-14 15:05:51 +02:00

xfrm6_mode_tunnel.c

ipv6: update skb->csum when CE mark is propagated

2016-01-15 15:07:23 -05:00

xfrm6_output.c

xfrm6: call kfree_skb when skb is toobig

2018-11-10 07:42:41 -08:00

xfrm6_policy.c

xfrm6: avoid potential infinite loop in _decode_session6()

2018-06-26 08:08:05 +08:00

xfrm6_protocol.c

…

xfrm6_state.c

…

xfrm6_tunnel.c

xfrm6_tunnel: Fix potential panic when unloading xfrm6_tunnel module

2019-05-25 18:26:54 +02:00