Florian Westphal f211ea001a netfilter: ctnetlink: fix refcnt leak in dying/unconfirmed list dumper ...

commit cd5f336f17 upstream.

'last' keeps track of the ct that had its refcnt bumped during previous
dump cycle.  Thus it must not be overwritten until end-of-function.

Another (unrelated, theoretical) issue: Don't attempt to bump refcnt of a conntrack
whose reference count is already 0.  Such conntrack is being destroyed
right now, its memory is freed once we release the percpu dying spinlock.

Fixes: b7779d06 ('netfilter: conntrack: spinlock per cpu to protect special lists.')
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2014-07-09 11:21:32 -07:00

..

9p

Merge tag 'for-linus-3.15' of git://git.kernel.org/pub/scm/linux/kernel/git/ericvh/v9fs

2014-04-11 14:14:57 -07:00

802

neigh: use NEIGH_VAR_INIT in ndo_neigh_setup functions.

2014-01-16 11:31:58 -08:00

8021q

vlan: Fix lockdep warning with stacked vlan devices.

2014-05-16 22:14:49 -04:00

appletalk

appletalk: fix checkpatch error with indent

2014-02-14 16:18:32 -05:00

atm

net: Fix use after free by removing length arg from sk_data_ready callbacks.

2014-04-11 16:15:36 -04:00

ax25

net: Fix use after free by removing length arg from sk_data_ready callbacks.

2014-04-11 16:15:36 -04:00

batman-adv

batman-adv: fix NULL pointer dereferences

2014-05-31 10:07:14 +02:00

bluetooth

Bluetooth: Allow change security level on ATT_CID in slave role

2014-07-09 11:21:27 -07:00

bridge

bridge: Prevent insertion of FDB entry with disallowed vlan

2014-06-02 13:38:23 -07:00

caif

net: Fix use after free by removing length arg from sk_data_ready callbacks.

2014-04-11 16:15:36 -04:00

can

net: Use netlink_ns_capable to verify the permisions of netlink messages

2014-04-24 13:44:54 -04:00

ceph

crush: decode and initialize chooseleaf_vary_r

2014-05-16 21:29:55 +04:00

core

rtnetlink: fix userspace API breakage for iproute2 < v3.9.0

2014-06-26 15:17:34 -04:00

dcb

net: Use netlink_ns_capable to verify the permisions of netlink messages

2014-04-24 13:44:54 -04:00

dccp

ipv4: add a sock pointer to ip_queue_xmit()

2014-04-15 12:58:34 -04:00

decnet

net: Use netlink_ns_capable to verify the permisions of netlink messages

2014-04-24 13:44:54 -04:00

dns_resolver

…

dsa

net/dsa/dsa.c: increment chip_index during of_node handling on dsa_of_probe()

2014-05-16 16:56:33 -04:00

ethernet

net: eth_type_trans() should use skb_header_pointer()

2014-01-16 15:30:31 -08:00

hsr

hsr: replace del_timer by del_timer_sync

2014-03-27 15:28:06 -04:00

ieee802154

mac802154: make csma/cca parameters per-wpan

2014-04-01 16:25:51 -04:00

ipv4

udp: ipv4: do not waste time in __udp4_lib_mcast_demux_lookup

2014-06-26 15:17:34 -04:00

ipv6

ipip, sit: fix ipv4_{update_pmtu,redirect} calls

2014-06-26 15:17:33 -04:00

ipx

ipx: implement shutdown()

2014-02-12 19:26:32 -05:00

irda

net: add build-time checks for msg->msg_name size

2014-01-18 23:04:16 -08:00

iucv

af_iucv: wrong mapping of sent and confirmed skbs

2014-05-14 15:38:39 -04:00

key

net: Fix use after free by removing length arg from sk_data_ready callbacks.

2014-04-11 16:15:36 -04:00

l2tp

ipv4: add a sock pointer to ip_queue_xmit()

2014-04-15 12:58:34 -04:00

lapb

…

llc

llc: remove noisy WARN from llc_mac_hdr_init

2014-01-28 18:01:32 -08:00

mac80211

mac80211: fix a memory leak on sta rate selection table

2014-07-09 11:21:28 -07:00

mac802154

mac802154: fix duplicate #include headers

2014-04-07 13:18:44 -04:00

mpls

…

netfilter

netfilter: ctnetlink: fix refcnt leak in dying/unconfirmed list dumper

2014-07-09 11:21:32 -07:00

netlabel

…

netlink

netlink: Only check file credentials for implicit destinations

2014-06-02 16:34:09 -07:00

netrom

net: Fix use after free by removing length arg from sk_data_ready callbacks.

2014-04-11 16:15:36 -04:00

nfc

net: Fix use after free by removing length arg from sk_data_ready callbacks.

2014-04-11 16:15:36 -04:00

openvswitch

ipv4: add a sock pointer to dst->output() path.

2014-04-15 13:47:15 -04:00

packet

net: Use netlink_ns_capable to verify the permisions of netlink messages

2014-04-24 13:44:54 -04:00

phonet

net: Use netlink_ns_capable to verify the permisions of netlink messages

2014-04-24 13:44:54 -04:00

rds

net: Fix use after free by removing length arg from sk_data_ready callbacks.

2014-04-11 16:15:36 -04:00

rfkill

net: rfkill: move poll work to power efficient workqueue

2014-02-04 21:58:16 +01:00

rose

net: Fix use after free by removing length arg from sk_data_ready callbacks.

2014-04-11 16:15:36 -04:00

rxrpc

af_rxrpc: Fix XDR length check in rxrpc key demarshalling.

2014-05-16 15:24:47 -04:00

sched

net_sched: fix an oops in tcindex filter

2014-05-21 16:47:13 -04:00

sctp

sctp: Fix sk_ack_backlog wrap-around problem

2014-06-26 15:17:34 -04:00

sunrpc

SUNRPC: Fix a module reference leak in svc_handle_xprt

2014-07-06 18:59:10 -07:00

tipc

net: Use netlink_ns_capable to verify the permisions of netlink messages

2014-04-24 13:44:54 -04:00

unix

net: Fix use after free by removing length arg from sk_data_ready callbacks.

2014-04-11 16:15:36 -04:00

vmw_vsock

vsock: Make transport the proto owner

2014-05-05 13:13:50 -04:00

wimax

…

wireless

cfg80211: add cfg80211_sched_scan_stopped_rtnl

2014-05-05 15:14:57 +02:00

x25

net: Fix use after free by removing length arg from sk_data_ready callbacks.

2014-04-11 16:15:36 -04:00

xfrm

net: Use netlink_ns_capable to verify the permisions of netlink messages

2014-04-24 13:44:54 -04:00

compat.c

net/compat: convert to COMPAT_SYSCALL_DEFINE with changing parameter types

2014-03-06 16:30:45 +01:00

Kconfig

Merge branch 'for-3.15' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup

2014-04-03 13:05:42 -07:00

Makefile

net: move 6lowpan compression code to separate module

2014-01-15 15:36:38 -08:00

nonet.c

…

socket.c

net: use SYSCALL_DEFINEx for sys_recv

2014-04-16 15:15:05 -04:00

sysctl_net.c

…