Go to file
Sabrina Dubroca 3840538ad3 netfilter: ipt_CLUSTERIP: fix use-after-free of proc entry
When we delete a netns with a CLUSTERIP rule, clusterip_net_exit() is
called first, removing /proc/net/ipt_CLUSTERIP.
Then clusterip_config_entry_put() is called from clusterip_tg_destroy(),
and tries to remove its entry under /proc/net/ipt_CLUSTERIP/.

Fix this by checking that the parent directory of the entry to remove
hasn't already been deleted.

The following triggers a KASAN splat (stealing the reproducer from
202f59afd4, thanks to Jianlin Shi and Xin Long):

    ip netns add test
    ip link add veth0_in type veth peer name veth0_out
    ip link set veth0_in netns test
    ip netns exec test ip link set lo up
    ip netns exec test ip link set veth0_in up
    ip netns exec test iptables -I INPUT -d 1.2.3.4 -i veth0_in -j     \
        CLUSTERIP --new --clustermac 89:d4:47:eb:9a:fa --total-nodes 3 \
        --local-node 1 --hashmode sourceip-sourceport
    ip netns del test

Fixes: ce4ff76c15 ("netfilter: ipt_CLUSTERIP: make proc directory per net namespace")
Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
Reviewed-by: Xin Long <lucien.xin@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2017-07-19 11:53:25 +02:00
arch Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc 2017-07-11 21:34:24 -07:00
block Merge branch 'for-linus' of git://git.kernel.dk/linux-block 2017-07-11 15:36:52 -07:00
certs scripts/spelling.txt: add "intialise(d)" pattern and fix typo instances 2017-05-08 17:15:13 -07:00
crypto dmaengine updates for 4.13-rc1 2017-07-08 12:36:50 -07:00
Documentation dt-bindings: net: Remove duplicate NSP Ethernet MAC binding document 2017-07-15 21:27:56 -07:00
drivers atm: zatm: Fix an error handling path in 'zatm_init_one()' 2017-07-18 11:37:46 -07:00
firmware firmware/Makefile: force recompilation if makefile changes 2017-05-08 17:15:10 -07:00
fs Merge branch 'overlayfs-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/vfs 2017-07-12 09:28:55 -07:00
include Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf 2017-07-18 12:01:39 -07:00
init mm: allow slab_nomerge to be set at build time 2017-07-06 16:24:31 -07:00
ipc mqueue: fix a use-after-free in sys_mq_notify() 2017-07-09 14:37:19 -07:00
kernel Modules updates for v4.13 2017-07-12 17:22:01 -07:00
lib lib/bsearch.c: micro-optimize pivot position calculation 2017-07-10 16:32:35 -07:00
mm kasan: make get_wild_bug_type() static 2017-07-10 16:32:33 -07:00
net netfilter: ipt_CLUSTERIP: fix use-after-free of proc entry 2017-07-19 11:53:25 +02:00
samples samples/bpf: fix a build issue 2017-07-11 20:51:29 -07:00
scripts Modules updates for v4.13 2017-07-12 17:22:01 -07:00
security Merge branch 'work.memdup_user' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2017-07-05 16:05:24 -07:00
sound main drm pull for v4.13 2017-07-09 18:48:37 -07:00
tools Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2017-07-12 19:30:57 -07:00
usr ramfs: clarify help text that compression applies to ramfs as well as legacy ramdisk. 2017-07-06 16:24:30 -07:00
virt PPC: 2017-07-06 18:38:31 -07:00
.cocciconfig scripts: add Linux .cocciconfig for coccinelle 2016-07-22 12:13:39 +02:00
.get_maintainer.ignore Add hch to .get_maintainer.ignore 2015-08-21 14:30:10 -07:00
.gitattributes .gitattributes: set git diff driver for C source code files 2016-10-07 18:46:30 -07:00
.gitignore kbuild: Add support to generate LLVM assembly files 2017-04-25 08:13:52 +09:00
.mailmap power supply and reset changes for the v4.12 series (part 2) 2017-05-12 12:02:21 -07:00
COPYING
CREDITS avr32: remove support for AVR32 architecture 2017-05-01 09:27:15 +02:00
Kbuild kbuild: Consolidate header generation from ASM offset information 2017-04-13 05:43:37 +09:00
Kconfig kbuild: migrate all arch to the kconfig mainmenu upgrade 2010-09-19 22:54:11 -04:00
MAINTAINERS Merge branch 'i2c/for-4.13' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux 2017-07-12 10:04:56 -07:00
Makefile disable new gcc-7.1.1 warnings for now 2017-07-12 19:25:47 -07:00
README README: add a new README file, pointing to the Documentation/ 2016-10-24 08:12:35 -02:00

Linux kernel
============

This file was moved to Documentation/admin-guide/README.rst

Please notice that there are several guides for kernel developers and users.
These guides can be rendered in a number of formats, like HTML and PDF.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.
See Documentation/00-INDEX for a list of what is contained in each file.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.