kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-16 22:39:48 +00:00
Code Issues Releases Packages Activity
linux/net
History
Gao Feng dc491cdd2c net: sched: Fix one possible panic when no destroy callback 
commit c1a4872ebf upstream.

When qdisc fail to init, qdisc_create would invoke the destroy callback
to cleanup. But there is no check if the callback exists really. So it
would cause the panic if there is no real destroy callback like the qdisc
codel, fq, and so on.

Take codel as an example following:
When a malicious user constructs one invalid netlink msg, it would cause
codel_init->codel_change->nla_parse_nested failed.
Then kernel would invoke the destroy callback directly but qdisc codel
doesn't define one. It causes one panic as a result.

Now add one the check for destroy to avoid the possible panic.

Fixes: 87b60cfacf ("net_sched: fix error recovery at qdisc creation")
Signed-off-by: Gao Feng <gfree.wind@vip.163.com>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2017-07-21 07:42:17 +02:00
..
6lowpan 6lowpan: ndisc: no overreact if no short address is available 2016-09-19 20:19:34 +02:00
9p p9_client_readdir() fix 2017-05-03 08:36:38 -07:00
802 net: Kill dev_rebuild_header 2015-03-02 16:43:41 -05:00
8021q net: 8021q: Fix one possible panic caused by BUG_ON in free_netdev 2017-07-05 14:40:16 +02:00
appletalk appletalk: use IS_ENABLED() instead of checking for built-in or module 2016-09-10 21:19:10 -07:00
atm lec: use IS_ENABLED() instead of checking for built-in or module 2016-09-10 21:19:10 -07:00
ax25 ax25: Fix segfault after sock connection timeout 2017-02-04 09:47:09 +01:00
batman-adv batman-adv: Check for alloc errors when preparing TT local data 2016-12-02 10:46:59 +01:00
bluetooth Bluetooth: Fix user channel for 32bit userspace on 64bit kernel 2017-05-20 14:28:41 +02:00
bridge net: bridge: start hello timer only if device is up 2017-06-14 15:05:52 +02:00
caif net: caif: Fix a sleep-in-atomic bug in cfpkt_create_pfx 2017-07-05 14:40:14 +02:00
can can: Fix kernel panic at security_sock_rcv_skb 2017-02-18 15:11:40 +01:00
ceph libceph: force GFP_NOIO for socket allocations 2017-04-08 09:30:30 +02:00
core net: ethtool: Initialize buffer when querying device channel settings 2017-07-05 14:40:21 +02:00
dcb net: dcb: set error code on failures 2016-12-03 23:54:25 -05:00
dccp ipv6/dccp: do not inherit ipv6_mc_list from parent 2017-06-07 12:07:42 +02:00
decnet decnet: always not take dst->__refcnt when inserting dst into hash table 2017-07-05 14:40:16 +02:00
dns_resolver KEYS: Add a facility to restrict new links into a keyring 2016-04-11 22:37:37 +01:00
dsa net: dsa: Check return value of phy_connect_direct() 2017-07-05 14:40:23 +02:00
ethernet net: introduce device min_header_len 2017-02-18 15:11:43 +01:00
hsr net/hsr: Remove unused but set variable 2016-10-18 10:28:18 -04:00
ieee802154 ieee802154: 6lowpan: fix intra pan id check 2016-07-08 13:23:12 +02:00
ipv4 netfilter: use skb_to_full_sk in ip_route_me_harder 2017-07-05 14:40:28 +02:00
ipv6 ip6_tunnel, ip6_gre: fix setting of DSCP on encapsulated packets 2017-07-05 14:40:27 +02:00
ipx ipx: call ipxitf_put() in ioctl error path 2017-05-25 15:44:41 +02:00
irda irda: Fix lockdep annotations in hashbin_delete(). 2017-02-26 11:10:51 +01:00
iucv net/af_iucv: don't use paged skbs for TX on HiperSockets 2017-01-19 20:18:04 +01:00
kcm kcm: return immediately after copy_from_user() failure 2017-05-03 08:36:34 -07:00
key xfrm: Oops on error in pfkey_msg2xfrm_state() 2017-07-05 14:40:28 +02:00
l2tp l2tp: take a reference on sessions used in genetlink handlers 2017-07-05 14:40:19 +02:00
l3mdev net: ipv6: Remove l3mdev_get_saddr6 2016-09-10 23:12:53 -07:00
lapb net/lapb: tuse %*ph to dump buffers 2016-05-29 22:33:25 -07:00
llc net/llc: avoid BUG_ON() in skb_orphan() 2017-02-26 11:10:50 +01:00
mac80211 mac80211: initialize SMPS field in HT capabilities 2017-07-05 14:40:25 +02:00
mac802154 mac802154: use rate limited warnings for malformed frames 2016-09-19 20:19:34 +02:00
mpls mpls: Do not decrement alive counter for unregister events 2017-03-22 12:43:34 +01:00
ncsi net/ncsi: Improve HNCDSC AEN handler 2016-10-20 11:23:08 -04:00
netfilter netfilter: synproxy: fix conntrackd interaction 2017-07-05 14:40:16 +02:00
netlabel netlabel: Implement CALIPSO config functions for SMACK. 2016-06-27 15:06:18 -04:00
netlink netlink: Do not schedule work from sk_destruct 2016-12-05 19:43:42 -05:00
netrom netfilter: Remove spurios included of netfilter.h 2015-06-18 21:14:32 +02:00
nfc NFC: digital: Fix RTOX supervisor PDU handling 2016-07-11 02:02:03 +02:00
openvswitch openvswitch: Add missing case OVS_TUNNEL_KEY_ATTR_PAD 2017-03-30 09:41:21 +02:00
packet net/packet: fix missing net_device reference release 2017-06-07 12:07:43 +02:00
phonet sock: struct proto hash function may error 2016-02-11 03:54:14 -05:00
qrtr Merge tag 'qcom-soc-for-4.7-2' into net-next 2016-05-17 14:11:19 -04:00
rds RDS: TCP: unregister_netdevice_notifier() in error path of rds_tcp_init_net 2016-12-02 13:29:26 -05:00
rfkill rfkill: Use switch to demux userspace operations 2016-04-05 10:48:53 +02:00
rose rose: limit sk_filter trim to payload 2016-07-13 11:53:40 -07:00
rxrpc rxrpc: Fix several cases where a padded len isn't checked in ticket decode 2017-06-29 13:00:31 +02:00
sched net: sched: Fix one possible panic when no destroy callback 2017-07-21 07:42:17 +02:00
sctp sctp: check af before verify address in sctp_addr_id2transport 2017-07-05 14:40:27 +02:00
strparser strparser: destroy workqueue on module exit 2017-03-22 12:43:33 +01:00
sunrpc svcauth_gss: Close connection when dropping an incoming message 2017-04-12 12:41:17 +02:00
switchdev switchdev: Execute bridge ndos only for bridge ports 2016-10-19 10:58:04 -04:00
tipc tipc: allocate user memory with GFP_KERNEL flag 2017-07-05 14:40:27 +02:00
unix af_unix: Add sockaddr length checks before accessing sa_family in bind and connect handlers 2017-07-05 14:40:14 +02:00
vmw_vsock vsock/virtio: fix src/dst cid format 2017-01-09 08:32:23 +01:00
wimax net:wimax: Fix doucble word "the the" in networking.xml 2015-08-09 22:43:52 -07:00
wireless mac80211: strictly check mesh address extension mode 2017-06-24 07:11:13 +02:00
x25 net: x25: remove null checks on arrays calling_ae and called_ae 2016-09-09 18:13:30 -07:00
xfrm xfrm: fix stack access out of bounds with CONFIG_XFRM_SUB_POLICY 2017-07-05 14:40:28 +02:00
compat.c packet: compat support for sock_fprog 2016-06-09 23:41:03 -07:00
Kconfig strparser: Stream parser for messages 2016-08-17 19:36:23 -04:00
Makefile strparser: Stream parser for messages 2016-08-17 19:36:23 -04:00
socket.c net: socket: fix recvmmsg not returning error from sock_error 2017-02-26 11:10:51 +01:00
sysctl_net.c Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace 2016-10-06 09:52:23 -07:00