linux/include
Mikulas Patocka 20855fe209 tun: fix a crash bug and a memory leak
commit b09e786bd1 upstream.

This patch fixes a crash
tun_chr_close -> netdev_run_todo -> tun_free_netdev -> sk_release_kernel ->
sock_release -> iput(SOCK_INODE(sock))
introduced by commit 1ab5ecb90c

The problem is that this socket is embedded in struct tun_struct, it has
no inode, iput is called on invalid inode, which modifies invalid memory
and optionally causes a crash.

sock_release also decrements sockets_in_use, this causes a bug that
"sockets: used" field in /proc/*/net/sockstat keeps on decreasing when
creating and closing tun devices.

This patch introduces a flag SOCK_EXTERNALLY_ALLOCATED that instructs
sock_release to not free the inode and not decrement sockets_in_use,
fixing both memory corruption and sockets_in_use underflow.

It should be backported to 3.3 an 3.4 stabke.

Signed-off-by: Mikulas Patocka <mikulas@artax.karlin.mff.cuni.cz>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2012-08-09 08:31:30 -07:00
..
acpi Merge branch 'release' of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux 2012-05-05 10:06:06 -07:00
asm-generic thp: avoid atomic64_read in pmd_read_atomic for 32bit PAE 2012-07-16 09:04:42 -07:00
crypto crypto: user - Fix lookup of algorithms with IV generator 2012-03-29 19:52:47 +08:00
drm drm/radeon/kms: add new SI PCI ids 2012-06-10 00:36:18 +09:00
keys
linux tun: fix a crash bug and a memory leak 2012-08-09 08:31:30 -07:00
math-emu
media Merge branch 'v4l_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media 2012-05-14 11:23:37 -07:00
misc
mtd
net bonding: Fix corrupted queue_mapping 2012-07-16 09:03:47 -07:00
pcmcia
rdma Merge branches 'cma', 'cxgb3', 'cxgb4', 'ehca', 'iser', 'mad', 'nes', 'qib', 'srp' and 'srpt' into for-next 2012-03-19 09:50:33 -07:00
rxrpc
scsi SCSI: libsas: fix taskfile corruption in sas_ata_qc_fill_rtf 2012-07-16 09:04:37 -07:00
sound ALSA: hda - hide HDMI/ELD printks unless snd.debug=2 2012-04-10 14:53:55 +02:00
target target: Add generation of LOGICAL BLOCK ADDRESS OUT OF RANGE 2012-08-09 08:31:26 -07:00
trace Merge branch 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 2012-04-04 10:04:42 -07:00
video Merge branch 'platforms' of git://git.linaro.org/people/rmk/linux-arm 2012-03-27 18:17:02 -07:00
xen xen: do not map the same GSI twice in PVHVM guests. 2012-06-01 15:18:25 +08:00
Kbuild