Vladimir Oltean f68cbaed67 net: ipconfig: avoid use-after-free in ic_close_devs ... Due to the fact that ic_dev->dev is kept open in ic_close_dev, I had thought that ic_dev will not be freed either. But that is not the case, but instead "everybody dies" when ipconfig cleans up, and just the net_device behind ic_dev->dev remains allocated but not ic_dev itself. This is a problem because in ic_close_devs, for every net device that we're about to close, we compare it against the list of lower interfaces of ic_dev, to figure out whether we should close it or not. But since ic_dev itself is subject to freeing, this means that at some point in the middle of the list of ipconfig interfaces, ic_dev will have been freed, and we would be still attempting to iterate through its list of lower interfaces while checking whether to bring down the remaining ipconfig interfaces. There are multiple ways to avoid the use-after-free: we could delay freeing ic_dev until the very end (outside the while loop). Or an even simpler one: we can observe that we don't need ic_dev when iterating through its lowers, only ic_dev->dev, structure which isn't ever freed. So, by keeping ic_dev->dev in a variable assigned prior to freeing ic_dev, we can avoid all use-after-free issues. Fixes: 46acf7bdbc ("Revert "net: ipv4: handle DSA enabled master network devices"") Reported-by: kernel test robot <oliver.sang@intel.com> Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com> Reviewed-by: Florian Fainelli <f.fainelli@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>		2021-02-11 14:31:39 -08:00
..
bpfilter	net: Revert "net: optimize the sockptr_t for unified kernel/user address spaces"	2020-08-10 12:06:44 -07:00
netfilter	netfilter: nftables: add nft_parse_register_load() and use it	2021-01-27 22:53:29 +01:00
af_inet.c	inet: do not export inet_gro_{receive|complete}	2021-02-02 18:41:10 -08:00
ah4.c
arp.c	net: Exempt multicast addresses from five-second neighbor lifetime	2020-11-13 14:24:39 -08:00
bpf_tcp_ca.c	bpf: Remove hard-coded btf_vmlinux assumption from BPF verifier	2020-12-03 17:38:21 -08:00
cipso_ipv4.c	cipso: fix 'audit_secid' kernel-doc warning in cipso_ipv4.c	2020-09-08 20:03:36 -07:00
datagram.c
devinet.c	treewide: rename nla_strlcpy to nla_strscpy.	2020-11-16 08:08:54 -08:00
esp4.c	esp: avoid unneeded kmap_atomic call	2021-01-11 18:20:09 -08:00
esp4_offload.c	net: Simplify the calculation of variables	2021-01-27 11:49:55 +01:00
fib_frontend.c	ipv4: Ignore ECN bits for fib lookups in fib_compute_spec_dst()	2020-12-28 14:44:32 -08:00
fib_lookup.h	IPv4: Add "offload failed" indication to routes	2021-02-08 16:47:03 -08:00
fib_notifier.c
fib_rules.c	fib: use indirect call wrappers in the most common fib_rules_ops	2020-07-28 17:42:31 -07:00
fib_semantics.c	IPv4: Add "offload failed" indication to routes	2021-02-08 16:47:03 -08:00
fib_trie.c	IPv4: Extend 'fib_notify_on_flag_change' sysctl	2021-02-08 16:47:03 -08:00
fou.c	genetlink: move to smaller ops wherever possible	2020-10-02 19:11:11 -07:00
gre_demux.c	erspan: fix version 1 check in gre_parse_header()	2020-12-28 15:00:00 -08:00
gre_offload.c	ip_gre: add csum offload support for gre header	2021-01-29 20:39:14 -08:00
icmp.c	lsm,selinux: pass flowi_common instead of flowi to the LSM hooks	2020-11-23 18:36:21 -05:00
igmp.c
inet_connection_sock.c	tcp: fix TCP_USER_TIMEOUT with zero window	2021-01-18 19:59:17 -08:00
inet_diag.c	inet_diag: Fix error path to cancel the meseage in inet_req_diag_fill()	2020-11-17 16:08:36 -08:00
inet_fragment.c	inet: frags: batch fqdir destroy works	2020-12-12 15:08:54 -08:00
inet_hashtables.c	tcp: add some entropy in __inet_hash_connect()	2021-02-11 13:13:05 -08:00
inet_timewait_sock.c	net: Use generic ns_common::count	2020-08-19 14:06:36 +02:00
inetpeer.c
ip_forward.c
ip_fragment.c
ip_gre.c	ipv4/ipv6: switch to dev_get_tstats64	2020-11-09 17:50:28 -08:00
ip_input.c	net: use indirect call helpers for dst_input	2021-02-03 14:51:39 -08:00
ip_options.c	net: clean up codestyle for net/ipv4	2020-08-25 06:28:02 -07:00
ip_output.c	net: use indirect call helpers for dst_output	2021-02-03 14:51:39 -08:00
ip_sockglue.c	net: Remove duplicated midx check against 0	2020-08-25 06:23:59 -07:00
ip_tunnel.c	net: ip_tunnel: fix mtu calculation	2021-02-01 19:58:23 -08:00
ip_tunnel_core.c	net: ip_tunnel: clean up endianness conversions	2021-01-08 19:25:35 -08:00
ip_vti.c	vti: switch to dev_get_tstats64	2020-11-09 17:50:28 -08:00
ipcomp.c	ipcomp: assign if_id to child tunnel from parent tunnel	2020-07-09 12:55:37 +02:00
ipconfig.c	net: ipconfig: avoid use-after-free in ic_close_devs	2021-02-11 14:31:39 -08:00
ipip.c	ipv4/ipv6: switch to dev_get_tstats64	2020-11-09 17:50:28 -08:00
ipmr.c	ipmr: Use full VIF ID in netlink cache reports	2020-09-10 12:25:51 -07:00
ipmr_base.c
Kconfig	net: ipv4: remove duplicate "the the" phrase in Kconfig text	2020-08-18 16:02:16 -07:00
Makefile	udp_tunnel: add central NIC RX port offload infrastructure	2020-07-10 13:54:00 -07:00
metrics.c	treewide: rename nla_strlcpy to nla_strscpy.	2020-11-16 08:08:54 -08:00
netfilter.c	netfilter: use actual socket sk rather than skb sk when routing harder	2020-10-30 12:57:39 +01:00
netlink.c
nexthop.c	nexthop: Extract a helper for validation of get/del RTNL requests	2021-01-28 20:49:54 -08:00
ping.c	lsm,selinux: pass flowi_common instead of flowi to the LSM hooks	2020-11-23 18:36:21 -05:00
proc.c	net: proc: speedup /proc/net/netstat	2021-01-29 20:59:53 -08:00
protocol.c
raw.c	lsm,selinux: pass flowi_common instead of flowi to the LSM hooks	2020-11-23 18:36:21 -05:00
raw_diag.c
route.c	IPv4: Add "offload failed" indication to routes	2021-02-08 16:47:03 -08:00
syncookies.c	selinux/stable-5.11 PR 20201214	2020-12-16 11:01:04 -08:00
sysctl_net_ipv4.c	IPv4: Extend 'fib_notify_on_flag_change' sysctl	2021-02-08 16:47:03 -08:00
tcp.c	tcp: Add receive timestamp support for receive zerocopy.	2021-01-22 20:05:56 -08:00
tcp_bbr.c	tcp: only postpone PROBE_RTT if RTT is < current min_rtt estimate	2020-11-17 11:03:22 -08:00
tcp_bic.c
tcp_bpf.c	bpf, sockmap: Ensure SO_RCVBUF memory is observed on ingress redirect	2020-11-18 00:12:34 +01:00
tcp_cdg.c
tcp_cong.c	tcp: Set INET_ECN_xmit configuration in tcp_reinit_congestion_control	2020-11-20 18:09:47 -08:00
tcp_cubic.c	tcp_cubic: use memset and offsetof init	2021-01-15 20:22:16 -08:00
tcp_dctcp.c
tcp_dctcp.h
tcp_diag.c
tcp_fastopen.c	bpf: tcp: Add bpf_skops_established()	2020-08-24 14:35:00 -07:00
tcp_highspeed.c	Replace HTTP links with HTTPS ones: IPv*	2020-07-06 13:23:03 -07:00
tcp_htcp.c	Replace HTTP links with HTTPS ones: IPv*	2020-07-06 13:23:03 -07:00
tcp_hybla.c
tcp_illinois.c
tcp_input.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2021-01-28 17:09:31 -08:00
tcp_ipv4.c	net: indirect call helpers for ipv4/ipv6 dst_check functions	2021-02-03 14:51:40 -08:00
tcp_lp.c	net: ipv4: Fix some kerneldoc warnings in TCP Low Priority	2020-10-30 12:10:57 -07:00
tcp_metrics.c	fixes-v5.11	2020-12-14 16:40:27 -08:00
tcp_minisocks.c	tcp: parse mptcp options contained in reset packets	2020-12-14 17:30:06 -08:00
tcp_nv.c
tcp_offload.c
tcp_output.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2021-01-28 17:09:31 -08:00
tcp_rate.c
tcp_recovery.c	tcp: fix TLP timer not set when CA_STATE changes from DISORDER to OPEN	2021-01-23 21:33:01 -08:00
tcp_scalable.c	net: ipv4: delete repeated words	2020-08-24 17:31:20 -07:00
tcp_timer.c	tcp: make TCP_USER_TIMEOUT accurate for zero window probes	2021-01-23 19:32:51 -08:00
tcp_ulp.c
tcp_vegas.c	tcp: use semicolons rather than commas to separate statements	2020-10-13 17:11:52 -07:00
tcp_vegas.h
tcp_veno.c	Replace HTTP links with HTTPS ones: IPv*	2020-07-06 13:23:03 -07:00
tcp_westwood.c
tcp_yeah.c
tunnel4.c	tunnel4: add cb_handler to struct xfrm_tunnel	2020-07-09 12:51:36 +02:00
udp.c	udp: call udp_encap_enable for v6 sockets when enabling encap	2021-02-04 18:37:14 -08:00
udp_bpf.c	net: sk_msg: Simplify sk_psock initialization	2020-08-21 15:16:11 -07:00
udp_diag.c	net: udp: remove redundant initialization in udp_dump_one	2020-11-09 16:42:49 -08:00
udp_impl.h	net: pass a sockptr_t into ->setsockopt	2020-07-24 15:41:54 -07:00
udp_offload.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2021-02-02 14:21:31 -08:00
udp_tunnel_core.c	udp_tunnel: reshuffle NETIF_F_RX_UDP_TUNNEL_PORT checks	2021-01-07 12:53:29 -08:00
udp_tunnel_nic.c	udp_tunnel: add the ability to share port tables	2020-09-28 12:50:12 -07:00
udp_tunnel_stub.c	udp_tunnel: add central NIC RX port offload infrastructure	2020-07-10 13:54:00 -07:00
udplite.c	net/ipv4: remove compat_ip_{get,set}sockopt	2020-07-19 18:16:41 -07:00
xfrm4_input.c
xfrm4_output.c
xfrm4_policy.c
xfrm4_protocol.c
xfrm4_state.c
xfrm4_tunnel.c	xfrm: interface: fix the priorities for ipip and ipv6 tunnels	2020-10-09 12:29:48 +02:00