Files
linux/include/net
Eric Dumazet c86318e072 ipv6: do not clear pinet6 field
[ Upstream commit f77d602124 ]

We have seen multiple NULL dereferences in __inet6_lookup_established()

After analysis, I found that inet6_sk() could be NULL while the
check for sk_family == AF_INET6 was true.

Bug was added in linux-2.6.29 when RCU lookups were introduced in UDP
and TCP stacks.

Once an IPv6 socket, using SLAB_DESTROY_BY_RCU is inserted in a hash
table, we no longer can clear pinet6 field.

This patch extends logic used in commit fcbdf09d96
("net: fix nulls list corruptions in sk_prot_alloc")

TCP/UDP/UDPLite IPv6 protocols provide their own .clear_sk() method
to make sure we do not clear pinet6 field.

At socket clone phase, we do not really care, as cloning the parent (non
NULL) pinet6 is not adding a fatal race.

Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
2013-05-24 10:23:19 -07:00
..
2012-11-19 23:56:59 +01:00
2012-08-09 16:18:06 -07:00
2012-04-15 12:44:40 -04:00
2012-04-15 12:44:40 -04:00
2010-06-03 03:21:52 -07:00
2012-04-15 12:44:40 -04:00
2012-07-19 10:43:03 -07:00
2012-10-08 17:42:36 -04:00
2011-03-31 11:26:23 -03:00
2012-12-11 12:49:53 -05:00
2013-02-28 05:38:41 -08:00
2012-08-14 14:28:32 -07:00
2008-06-11 21:00:38 -07:00
2013-02-28 05:38:41 -08:00
2011-03-31 11:26:23 -03:00
2012-05-17 18:45:20 -04:00
2008-02-29 11:46:17 -08:00
2010-06-03 03:21:52 -07:00
2012-08-07 16:24:55 -07:00
2009-01-06 11:38:15 -07:00
2011-05-17 14:16:58 -04:00
2009-03-21 19:06:50 -07:00
2012-05-19 01:08:16 -04:00
2012-11-03 14:59:04 -04:00
2013-05-01 09:46:20 -07:00
2012-08-06 13:40:47 -07:00
2013-05-24 10:23:19 -07:00
2008-07-05 21:25:39 -07:00
2009-10-07 16:39:43 -04:00
2012-04-15 12:44:40 -04:00
2012-05-16 15:17:08 -04:00
2012-04-15 12:44:40 -04:00