linux/net/core
Francesco Ruggeri 07a5d38453 net: possible use after free in dst_release
dst_release should not access dst->flags after decrementing
__refcnt to 0. The dst_entry may be in dst_busy_list and
dst_gc_task may dst_destroy it before dst_release gets a chance
to access dst->flags.

Fixes: d69bbf88c8 ("net: fix a race in dst_release()")
Fixes: 27b75c95f1 ("net: avoid RCU for NOCACHE dst")
Signed-off-by: Francesco Ruggeri <fruggeri@arista.com>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2016-01-06 15:00:27 -05:00
..
Makefile
datagram.c net: rename SOCK_ASYNC_NOSPACE and SOCK_ASYNC_WAITDATA 2015-12-01 15:45:05 -05:00
dev.c net/core: revert "net: fix __netdev_update_features return.." and add comment 2015-11-17 15:25:45 -05:00
dev_addr_lists.c
dev_ioctl.c
drop_monitor.c
dst.c net: possible use after free in dst_release 2016-01-06 15:00:27 -05:00
ethtool.c
fib_rules.c
filter.c
flow.c
flow_dissector.c
gen_estimator.c
gen_stats.c
link_watch.c
lwtunnel.c
neighbour.c net/neighbour: fix crash at dumping device-agnostic proxy entries 2015-12-03 00:07:51 -05:00
net-procfs.c
net-sysfs.c
net-sysfs.h
net-traces.c
net_namespace.c
netclassid_cgroup.c Merge branch 'master' into for-4.4-fixes 2015-12-07 10:09:03 -05:00
netevent.c
netpoll.c
netprio_cgroup.c cgroup: fix handling of multi-destination migration from subtree_control enabling 2015-12-03 10:18:21 -05:00
pktgen.c
ptp_classifier.c
request_sock.c
rtnetlink.c rtnetlink: fix frame size warning in rtnl_fill_ifinfo 2015-11-17 15:25:44 -05:00
scm.c net, scm: fix PaX detected msg_controllen overflow in scm_detach_fds 2015-11-22 20:34:58 -05:00
secure_seq.c
skbuff.c net: check both type and procotol for tcp sockets 2015-12-17 15:46:32 -05:00
sock.c net: check both type and procotol for tcp sockets 2015-12-17 15:46:32 -05:00
sock_diag.c
stream.c net: fix sock_wake_async() rcu protection 2015-12-01 15:45:05 -05:00
sysctl_net_core.c
timestamping.c
tso.c
utils.c