github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-06-09 07:03:37 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph
019b1332af
linux/net
History
Nikolay Aleksandrov 019b1332af bridge: fix br_stp_set_bridge_priority race conditions 
[ Upstream commit 2dab80a8b4 ]

After the ->set() spinlocks were removed br_stp_set_bridge_priority
was left running without any protection when used via sysfs. It can
race with port add/del and could result in use-after-free cases and
corrupted lists. Tested by running port add/del in a loop with stp
enabled while setting priority in a loop, crashes are easily
reproducible.
The spinlocks around sysfs ->set() were removed in commit:
14f98f258f ("bridge: range check STP parameters")
There's also a race condition in the netlink priority support that is
fixed by this change, but it was introduced recently and the fixes tag
covers it, just in case it's needed the commit is:
af615762e9 ("bridge: add ageing_time, stp_state, priority over netlink")

Signed-off-by: Nikolay Aleksandrov <razor@blackwall.org>
Fixes: 14f98f258f ("bridge: range check STP parameters")
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-07-10 10:40:20 -07:00
..
9p 9p/trans_virtio.c: Fix broken zero-copy on vmalloc() buffers 2014-03-06 21:30:03 -08:00
802 net/802/mrp: fix lockdep splat 2013-05-14 13:02:30 -07:00
8021q 8021q: fix a potential memory leak 2014-07-28 08:00:04 -07:00
appletalk appletalk: Fix socket referencing in skb 2014-07-28 08:00:05 -07:00
atm net: rework recvmsg handler msg_name and msg_namelen logic 2013-12-08 07:29:25 -08:00
ax25 net: rework recvmsg handler msg_name and msg_namelen logic 2013-12-08 07:29:25 -08:00
batman-adv batman-adv: set up network coding packet handlers during module init 2013-11-20 12:27:47 -08:00
bluetooth Bluetooth: Avoid use of session socket after the session gets freed 2014-09-17 09:04:00 -07:00
bridge bridge: fix br_stp_set_bridge_priority race conditions 2015-07-10 10:40:20 -07:00
caif unix/caif: sk_socket can disappear when state is unlocked 2015-06-22 16:55:51 -07:00
can can: add missing initialisations in CAN related skbuffs 2015-03-26 15:00:58 +01:00
ceph libceph: request a new osdmap if lingering request maps to no osd 2015-06-05 23:19:54 -07:00
core net: sysctl_net_core: check SNDBUF and RCVBUF for min length 2015-03-26 15:00:55 +01:00
dcb net: Use netlink_ns_capable to verify the permisions of netlink messages 2014-06-26 15:12:37 -04:00
dccp net:dccp: do not report ICMP redirects to user space 2013-10-13 16:08:30 -07:00
decnet net: Use netlink_ns_capable to verify the permisions of netlink messages 2014-06-26 15:12:37 -04:00
dns_resolver dns_resolver: Null-terminate the right string 2014-07-28 08:00:06 -07:00
dsa dsa: fix freeing of sparse port allocation 2013-03-25 12:23:41 -04:00
ethernet net: add ETH_P_802_3_MIN 2013-03-28 01:20:42 -04:00
ieee802154 6lowpan: fix lockdep splats 2014-03-06 21:30:02 -08:00
ipv4 xfrm: Increase the garbage collector threshold 2015-07-03 19:48:09 -07:00
ipv6 ipv6: update ip6_rt_last_gc every time GC is run 2015-07-03 19:48:09 -07:00
ipx ipx: fix locking regression in ipx_sendmsg and ipx_recvmsg 2014-12-06 15:05:47 -08:00
irda net: irda: fix wait_until_sent poll timeout 2015-03-18 13:22:31 +01:00
iucv af_iucv: wrong mapping of sent and confirmed skbs 2014-06-30 20:09:40 -07:00
key net: rework recvmsg handler msg_name and msg_namelen logic 2013-12-08 07:29:25 -08:00
l2tp l2tp: fix race while getting PMTU on PPP pseudo-wire 2014-10-15 08:31:57 +02:00
lapb
llc net: llc: use correct size for sysctl timeout entries 2015-04-19 10:10:50 +02:00
mac80211 mac80211: drop unencrypted frames in mesh fwding 2015-04-13 14:02:11 +02:00
mac802154 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2013-04-30 03:55:20 -04:00
netfilter netfilter: Zero the tuple in nfnl_cthelper_parse_tuple() 2015-07-03 19:48:08 -07:00
netlabel netlabel: improve domain mapping validation 2013-05-19 14:49:55 -07:00
netlink netlink: Don't reorder loads/stores before marking mmap netlink frame as available 2015-01-27 07:52:30 -08:00
netrom net: rework recvmsg handler msg_name and msg_namelen logic 2013-12-08 07:29:25 -08:00
nfc net: rework recvmsg handler msg_name and msg_namelen logic 2013-12-08 07:29:25 -08:00
openvswitch openvswitch: fix panic with multiple vlan headers 2014-10-15 08:31:57 +02:00
packet packet: handle too big packets for PACKET_V3 2014-10-15 08:31:56 +02:00
phonet net: Use netlink_ns_capable to verify the permisions of netlink messages 2014-06-26 15:12:37 -04:00
rds net: rds: use correct size for max unacked packets and bytes 2015-04-19 10:10:50 +02:00
rfkill Merge branch 'for-john' of git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211-next 2013-04-22 14:58:14 -04:00
rose net: rose: restore old recvmsg behavior 2014-01-15 15:28:49 -08:00
rxrpc rxrpc: bogus MSG_PEEK test in rxrpc_recvmsg() 2015-03-26 15:00:56 +01:00
sched net_sched: invoke ->attach() after setting dev->qdisc 2015-06-22 16:55:51 -07:00
sctp net: sctp: fix passing wrong parameter header to param_type2af in sctp_process_param 2015-02-26 17:48:49 -08:00
sunrpc svcrpc: fix potential GSSX_ACCEPT_SEC_CONTEXT decoding failures 2015-06-05 23:19:59 -07:00
tipc tipc: clear 'next'-pointer of message fragments before reassembly 2014-07-28 08:00:05 -07:00
unix unix/caif: sk_socket can disappear when state is unlocked 2015-06-22 16:55:51 -07:00
vmw_vsock net: rework recvmsg handler msg_name and msg_namelen logic 2013-12-08 07:29:25 -08:00
wimax
wireless cfg80211: wext: clear sinfo struct before calling driver 2015-06-22 16:55:54 -07:00
x25 net: rework recvmsg handler msg_name and msg_namelen logic 2013-12-08 07:29:25 -08:00
xfrm net: Use netlink_ns_capable to verify the permisions of netlink messages 2014-06-26 15:12:37 -04:00
compat.c net: compat: Update get_compat_msghdr() to match copy_msghdr_from_user() behaviour 2015-03-26 15:00:56 +01:00
Kconfig netlink: kconfig: move mmap i/o into netlink kconfig 2013-05-01 15:02:42 -04:00
Makefile VSOCK: Introduce VM Sockets 2013-02-10 19:41:08 -05:00
nonet.c
socket.c net: socket: Fix the wrong returns for recvmsg and sendmsg 2015-06-05 23:19:53 -07:00
sysctl_net.c net: Update the sysctl permissions handler to test effective uid/gid 2013-10-13 16:08:34 -07:00