Eric Dumazet 7d9577d0b2 ipv6: do not clear pinet6 field ... [ Upstream commit f77d602124 ] We have seen multiple NULL dereferences in __inet6_lookup_established() After analysis, I found that inet6_sk() could be NULL while the check for sk_family == AF_INET6 was true. Bug was added in linux-2.6.29 when RCU lookups were introduced in UDP and TCP stacks. Once an IPv6 socket, using SLAB_DESTROY_BY_RCU is inserted in a hash table, we no longer can clear pinet6 field. This patch extends logic used in commit fcbdf09d96 ("net: fix nulls list corruptions in sk_prot_alloc") TCP/UDP/UDPLite IPv6 protocols provide their own .clear_sk() method to make sure we do not clear pinet6 field. At socket clone phase, we do not really care, as cloning the parent (non NULL) pinet6 is not adding a fatal race. Signed-off-by: Eric Dumazet <edumazet@google.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2013-05-19 10:54:47 -07:00
..
9p	9p: Reduce object size with CONFIG_NET_9P_DEBUG	2012-01-05 10:51:44 -06:00
bluetooth	Bluetooth: Change signature of smp_conn_security()	2012-10-02 10:30:34 -07:00
caif	caif-hsi: Add RX flip buffer	2012-02-04 16:06:28 -05:00
irda
iucv	af_iucv: add shutdown for HS transport	2012-03-07 22:52:24 -08:00
netfilter	netfilter: nf_conntrack: fix racy timer handling with reliable events	2012-10-21 09:28:00 -07:00
netns	BUG: headers with BUG/BUG_ON etc. need linux/bug.h	2012-03-04 17:54:34 -05:00
nfc	NFC: NCI code identation fixes	2012-03-06 15:16:25 -05:00
phonet
sctp	sctp: check cached dst before using it	2012-05-10 23:15:47 -04:00
tc_act
act_api.h
addrconf.h	ipv6: Remove never used function inet6_ac_check().	2012-02-01 16:14:17 -05:00
af_ieee802154.h
af_rxrpc.h
af_unix.h	switch unix_sock to struct path	2012-03-20 21:29:41 -04:00
ah.h
arp.h	ipv4: Eliminate spurious argument to __ipv4_neigh_lookup	2012-02-15 17:48:35 -05:00
atmclip.h	atm: clip: Use device neigh support on top of "arp_tbl".	2011-11-30 18:51:03 -05:00
ax25.h
ax88796.h
cfg80211-wext.h
cfg80211.h	mac80211: verify that skb data is present	2012-11-17 13:16:11 -08:00
checksum.h
cipso_ipv4.h	cipso: handle CIPSO options correctly when NetLabel is disabled	2012-07-16 09:03:44 -07:00
cls_cgroup.h
compat.h	net: get rid of some pointless casts to sockaddr	2012-03-11 19:11:22 -07:00
datalink.h
dcbevent.h
dcbnl.h	net: dcb: getnumtcs()/setnumtcs() should return an int	2012-03-02 18:16:49 -08:00
dn.h	decnet: net/dn.h needs net/flow.h	2012-02-15 16:37:44 -05:00
dn_dev.h
dn_fib.h
dn_neigh.h
dn_nsp.h
dn_route.h
dsa.h	dsa: Include linux/if_ether.h to fix build error	2011-12-01 11:41:06 -05:00
dsfield.h
dst.h	ipv6: fix incorrect ipsec fragment	2012-06-10 00:36:15 +09:00
dst_ops.h	net: Rename the dst_opt default_mtu method to mtu	2011-11-26 14:29:50 -05:00
esp.h
ethoc.h
fib_rules.h
flow.h	ipv4: reset flowi parameters on route connect	2012-02-04 19:29:48 -05:00
flow_keys.h	flow_dissector: use a 64bit load/store	2011-11-29 13:17:03 -05:00
garp.h
gen_stats.h
genetlink.h	net: Deinline __nlmsg_put and genlmsg_put. -7k code on i386 defconfig.	2012-01-30 15:22:06 -05:00
gre.h
icmp.h
ieee80211_radiotap.h	wireless: move ieee80211chan2mhz macro	2011-11-11 12:32:50 -05:00
ieee802154.h	6LoWPAN: add fragmentation support	2011-11-14 00:19:42 -05:00
ieee802154_netdev.h
if_inet6.h
inet6_connection_sock.h
inet6_hashtables.h	ipv6: use a stronger hash for tcp	2013-02-28 06:59:06 -08:00
inet_common.h
inet_connection_sock.h	inet: Fix kmemleak in tcp_v4/6_syn_recv_sock and dccp_v4/6_request_recv_sock	2013-01-11 09:07:14 -08:00
inet_ecn.h
inet_frag.h	inet: limit length of fragment queue hash table bucket lists	2013-03-28 12:11:54 -07:00
inet_hashtables.h
inet_sock.h	ipv6: use a stronger hash for tcp	2013-02-28 06:59:06 -08:00
inet_timewait_sock.h	inet: remove rcu protection on tw_net	2011-12-14 13:34:55 -05:00
inetpeer.h	inetpeer: fix a race in inetpeer_gc_worker()	2012-07-16 09:03:45 -07:00
ip.h	ipv4: Make ip_call_ra_chain() return bool.	2012-03-09 14:34:50 -08:00
ip6_checksum.h
ip6_fib.h	ipv6: clean up rt6_clean_expires	2012-04-17 22:31:59 -04:00
ip6_route.h	Merge branch 'nf-next' of git://1984.lsi.us.es/net-next	2011-12-25 02:21:45 -05:00
ip6_tunnel.h
ip_fib.h	ipv4: fix definition of FIB_TABLE_HASHSZ	2013-03-28 12:11:53 -07:00
ip_vs.h	ipvs: fix oops on NAT reply in br_nf context	2012-10-21 09:28:00 -07:00
ipcomp.h
ipconfig.h
ipip.h
ipv6.h	ipv6: use a stronger hash for tcp	2013-02-28 06:59:06 -08:00
ipx.h
iw_handler.h
lapb.h
lib80211.h
llc.h
llc_c_ac.h
llc_c_ev.h
llc_c_st.h
llc_conn.h
llc_if.h
llc_pdu.h
llc_s_ac.h
llc_s_ev.h
llc_s_st.h
llc_sap.h
mac80211.h	mac80211: Convert WARN_ON to WARN_ON_ONCE	2012-04-09 15:54:48 -04:00
mip6.h
mld.h
ndisc.h	ipv6: Remove neigh argument from ndisc_send_redirect()	2012-01-27 21:00:08 -05:00
neighbour.h	ipv6: Use universal hash for NDISC.	2011-12-28 15:06:58 -05:00
net_namespace.h	net: use IS_ENABLED(CONFIG_IPV6)	2011-12-11 18:25:16 -05:00
net_ratelimit.h
netdma.h
netevent.h
netlabel.h
netlink.h	net: Deinline __nlmsg_put and genlmsg_put. -7k code on i386 defconfig.	2012-01-30 15:22:06 -05:00
netprio_cgroup.h	netprio_cgroup: fix wrong memory access when NETPRIO_CGROUP=m	2012-02-10 15:08:57 -05:00
netrom.h
nexthop.h
nl802154.h
p8022.h
ping.h
pkt_cls.h
pkt_sched.h
protocol.h	net: use IS_ENABLED(CONFIG_IPV6)	2011-12-11 18:25:16 -05:00
psnap.h
raw.h
rawv6.h
red.h	net_sched: red: Make minor corrections to comments	2012-04-16 23:53:11 -04:00
regulatory.h	cfg80211: pass DFS region to drivers through reg_notifier()	2011-11-21 16:20:41 -05:00
request_sock.h
rose.h
route.h	ipv4: reset flowi parameters on route connect	2012-02-04 19:29:48 -05:00
rtnetlink.h	rtnetlink: Fix problem with buffer allocation	2012-02-21 16:56:45 -05:00
sch_generic.h	bonding: Fix corrupted queue_mapping	2012-07-16 09:03:47 -07:00
scm.h	net: fix incorrect credentials passing	2013-05-01 09:41:16 -07:00
secure_seq.h
slhc_vj.h
snmp.h	Merge branch 'for-3.3' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/percpu	2012-01-09 13:08:28 -08:00
sock.h	ipv6: do not clear pinet6 field	2013-05-19 10:54:47 -07:00
stp.h
tcp.h	tcp: force a dst refcount when prequeue packet	2013-05-19 10:54:43 -07:00
tcp_memcontrol.h	cgroup: remove cgroup_subsys argument from callbacks	2012-02-02 09:20:22 -08:00
tcp_states.h
timewait_sock.h	BUG: headers with BUG/BUG_ON etc. need linux/bug.h	2012-03-04 17:54:34 -05:00
transp_v6.h
udp.h	BUG: headers with BUG/BUG_ON etc. need linux/bug.h	2012-03-04 17:54:34 -05:00
udplite.h	net: ipv4: Standardize prefixes for message logging	2012-03-12 17:05:21 -07:00
wext.h
wimax.h
wpan-phy.h	BUG: headers with BUG/BUG_ON etc. need linux/bug.h	2012-03-04 17:54:34 -05:00
x25.h
x25device.h
xfrm.h	xfrm: Workaround incompatibility of ESN and async crypto	2012-10-13 05:38:40 +09:00