Ido Schimmel b4681c2829 ipv4: Fix use-after-free when flushing FIB tables ... Since commit 0ddcf43d5d ("ipv4: FIB Local/MAIN table collapse") the local table uses the same trie allocated for the main table when custom rules are not in use. When a net namespace is dismantled, the main table is flushed and freed (via an RCU callback) before the local table. In case the callback is invoked before the local table is iterated, a use-after-free can occur. Fix this by iterating over the FIB tables in reverse order, so that the main table is always freed after the local table. v3: Reworded comment according to Alex's suggestion. v2: Add a comment to make the fix more explicit per Dave's and Alex's feedback. Fixes: 0ddcf43d5d ("ipv4: FIB Local/MAIN table collapse") Signed-off-by: Ido Schimmel <idosch@mellanox.com> Reported-by: Fengguang Wu <fengguang.wu@intel.com> Acked-by: Alexander Duyck <alexander.h.duyck@intel.com> Signed-off-by: David S. Miller <davem@davemloft.net>		2017-12-20 15:12:39 -05:00
..
netfilter
af_inet.c
ah4.c
arp.c
cipso_ipv4.c
datagram.c
devinet.c
esp4.c
esp4_offload.c
fib_frontend.c	ipv4: Fix use-after-free when flushing FIB tables	2017-12-20 15:12:39 -05:00
fib_lookup.h
fib_notifier.c
fib_rules.c
fib_semantics.c	ipv4: fib: Fix metrics match when deleting a route	2017-12-19 14:21:58 -05:00
fib_trie.c
fou.c
gre_demux.c
gre_offload.c
icmp.c
igmp.c
inet_connection_sock.c
inet_diag.c
inet_fragment.c
inet_hashtables.c
inet_timewait_sock.c
inetpeer.c
ip_forward.c
ip_fragment.c
ip_gre.c	ip_gre: remove the incorrect mtu limit for ipgre tap	2017-12-19 13:45:32 -05:00
ip_input.c
ip_options.c
ip_output.c
ip_sockglue.c
ip_tunnel.c
ip_tunnel_core.c
ip_vti.c
ipcomp.c
ipconfig.c
ipip.c
ipmr.c
Kconfig
Makefile
netfilter.c
ping.c
proc.c
protocol.c
raw.c
raw_diag.c
route.c
syncookies.c
sysctl_net_ipv4.c
tcp.c
tcp_bbr.c
tcp_bic.c
tcp_cdg.c
tcp_cong.c
tcp_cubic.c
tcp_dctcp.c
tcp_diag.c
tcp_fastopen.c
tcp_highspeed.c
tcp_htcp.c
tcp_hybla.c
tcp_illinois.c
tcp_input.c
tcp_ipv4.c
tcp_lp.c
tcp_metrics.c
tcp_minisocks.c
tcp_nv.c
tcp_offload.c
tcp_output.c
tcp_probe.c
tcp_rate.c
tcp_recovery.c
tcp_scalable.c
tcp_timer.c
tcp_ulp.c
tcp_vegas.c
tcp_vegas.h
tcp_veno.c
tcp_westwood.c
tcp_yeah.c
tunnel4.c
udp.c
udp_diag.c
udp_impl.h
udp_offload.c
udp_tunnel.c
udplite.c
xfrm4_input.c
xfrm4_mode_beet.c
xfrm4_mode_transport.c
xfrm4_mode_tunnel.c
xfrm4_output.c
xfrm4_policy.c
xfrm4_protocol.c
xfrm4_state.c
xfrm4_tunnel.c