OpenE2K
/
linux
6
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity
linux/net
History
Patrick McHardy 5397e97d75 [NETFILTER]: nf_conntrack: fix use-after-free in helper destroy callback invocation 
When the helper module is removed for a master connection that has a
fulfilled expectation, but has already timed out and got removed from
the hash tables, nf_conntrack_helper_unregister can't find the master
connection to unset the helper, causing a use-after-free when the
expected connection is destroyed and releases the last reference to
the master.

The helper destroy callback was introduced for the PPtP helper to clean
up expectations and expected connections when the master connection
times out, but doing this from destroy_conntrack only works for
unfulfilled expectations since expected connections hold a reference
to the master, preventing its destruction. Move the destroy callback to
the timeout function, which fixes both problems.

Reported/tested by Gabor Burjan <buga@buvoshetes.hu>.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
 		2007-05-19 14:23:52 -07:00
..
802 [NET]: cleanup extra semicolons 2007-04-25 22:29:24 -07:00
8021q [NET]: Rework dev_base via list_head (v3) 2007-05-03 15:13:45 -07:00
appletalk header cleaning: don't include smp_lock.h when not used 2007-05-08 11:15:07 -07:00
atm [NET]: SPIN_LOCK_UNLOCKED cleanup in drivers/atm, net 2007-04-26 01:37:44 -07:00
ax25 [S390] Kconfig: unwanted menus for s390. 2007-05-10 15:46:07 +02:00
bluetooth [BLUETOOTH]: Fix locking in hci_sock_dev_event(). 2007-05-17 14:20:30 -07:00
bridge header cleaning: don't include smp_lock.h when not used 2007-05-08 11:15:07 -07:00
core [NET]: Fix net/core/skbuff.c gcc-3.2.3 compilation error 2007-05-19 13:55:25 -07:00
dccp [NET]: SPIN_LOCK_UNLOCKED cleanup in drivers/atm, net 2007-04-26 01:37:44 -07:00
decnet Fix occurrences of "the the " 2007-05-09 08:57:56 +02:00
econet [SK_BUFF]: Convert skb->tail to sk_buff_data_t 2007-04-25 22:26:28 -07:00
ethernet [SK_BUFF]: Introduce skb_reset_mac_header(skb) 2007-04-25 22:24:32 -07:00
ieee80211 [PATCH] ieee80211: include frequency in scan results 2007-05-08 11:51:59 -04:00
ipv4 [TCP] FRTO: Prevent state inconsistency in corner cases 2007-05-19 13:56:57 -07:00
ipv6 [IPV6]: Reverse sense of promisc tests in ip6_mc_input 2007-05-14 03:00:27 -07:00
ipx Fix incorrect prototype for ipxrtr_route_packet() 2007-05-17 05:25:49 -07:00
irda [S390] Kconfig: unwanted menus for s390. 2007-05-10 15:46:07 +02:00
iucv Add suspend-related notifications for CPU hotplug 2007-05-09 12:30:56 -07:00
key [IPSEC] pfkey: Load specific algorithm in pfkey_add rather than all 2007-05-19 14:21:18 -07:00
lapb [PATCH] remove many unneeded #includes of sched.h 2007-02-14 08:09:54 -08:00
llc Fix occurrences of "the the " 2007-05-09 08:57:56 +02:00
mac80211 [MAC80211]: include <linux/delay.h> instead of <asm/delay.h> 2007-05-10 23:45:09 -07:00
netfilter [NETFILTER]: nf_conntrack: fix use-after-free in helper destroy callback invocation 2007-05-19 14:23:52 -07:00
netlabel SELinux: extract the NetLabel SELinux support from the security server 2007-04-26 01:35:48 -04:00
netlink header cleaning: don't include smp_lock.h when not used 2007-05-08 11:15:07 -07:00
netrom [NET]: Rework dev_base via list_head (v3) 2007-05-03 15:13:45 -07:00
packet [AF_PACKET]: Add option to return orig_dev to userspace. 2007-04-25 22:29:14 -07:00
rfkill [RFKILL]: Fix check for correct rfkill allocation 2007-05-19 12:24:39 -07:00
rose [NET]: Rework dev_base via list_head (v3) 2007-05-03 15:13:45 -07:00
rxrpc AF_RXRPC: reduce debugging noise 2007-05-10 09:26:52 -07:00
sched [NET_SCHED]: prio qdisc boundary condition 2007-05-14 02:57:19 -07:00
sctp [SCTP]: Do not include ABORT chunk header in the notification. 2007-05-10 23:45:31 -07:00
sunrpc Merge branch 'master' of /home/trondmy/repositories/git/linux-2.6/ 2007-05-17 11:36:59 -04:00
tipc Merge git://git.kernel.org/pub/scm/linux/kernel/git/sam/kbuild 2007-05-06 13:21:57 -07:00
unix header cleaning: don't include smp_lock.h when not used 2007-05-08 11:15:07 -07:00
wanrouter [SK_BUFF]: Introduce skb_copy_to_linear_data{_offset} 2007-04-25 22:28:29 -07:00
wireless [WIRELESS] cfg80211: Clarify locking comment. 2007-04-26 20:51:12 -07:00
x25 header cleaning: don't include smp_lock.h when not used 2007-05-08 11:15:07 -07:00
xfrm [IPSEC] pfkey: Load specific algorithm in pfkey_add rather than all 2007-05-19 14:21:18 -07:00
Kconfig [S390] Kconfig: no wireless on s390. 2007-05-10 15:46:08 +02:00
Makefile [NET]: rfkill: add support for input key to control wireless radio 2007-05-07 00:34:20 -07:00
TUNABLE
…
compat.c [NET]: Adding SO_TIMESTAMPNS / SCM_TIMESTAMPNS support 2007-04-25 22:24:21 -07:00
nonet.c
…
socket.c Remove SLAB_CTOR_CONSTRUCTOR 2007-05-17 05:23:04 -07:00
sysctl_net.c Remove obsolete #include <linux/config.h> 2006-06-30 19:25:36 +02:00