redonkable
/
alistair23-linux
1
0
Fork 0
Code Releases Activity
alistair23-linux/net/ipv4/netfilter
History
Cong Wang b3e456fce9 netfilter: ipt_CLUSTERIP: fix a race condition of proc file creation 
There is a race condition between clusterip_config_entry_put()
and clusterip_config_init(), after we release the spinlock in
clusterip_config_entry_put(), a new proc file with a same IP could
be created immediately since it is already removed from the configs
list, therefore it triggers this warning:

------------[ cut here ]------------
proc_dir_entry 'ipt_CLUSTERIP/172.20.0.170' already registered
WARNING: CPU: 1 PID: 4152 at fs/proc/generic.c:330 proc_register+0x2a4/0x370 fs/proc/generic.c:329
Kernel panic - not syncing: panic_on_warn set ...

As a quick fix, just move the proc_remove() inside the spinlock.

Reported-by: <syzbot+03218bcdba6aa76441a3@syzkaller.appspotmail.com>
Fixes: 6c5d5cfbe3 ("netfilter: ipt_CLUSTERIP: check duplicate config when initializing")
Tested-by: Paolo Abeni <pabeni@redhat.com>
Cc: Xin Long <lucien.xin@gmail.com>
Cc: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Reviewed-by: Xin Long <lucien.xin@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
 		2018-02-08 13:54:20 +01:00
..
Kconfig netfilter: flowtable infrastructure depends on NETFILTER_INGRESS 2018-02-02 13:21:48 +01:00
Makefile netfilter: nf_nat_snmp_basic: use asn1 decoder library 2018-01-19 13:59:07 +01:00
arp_tables.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next 2018-01-31 14:31:10 -08:00
arpt_mangle.c netfilter: arpt_mangle: fix return values of checkentry 2011-02-01 16:03:46 +01:00
arptable_filter.c netfilter: arp_tables: register table in initns 2016-04-07 11:58:49 +02:00
ip_tables.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next 2018-01-31 14:31:10 -08:00
ipt_CLUSTERIP.c netfilter: ipt_CLUSTERIP: fix a race condition of proc file creation 2018-02-08 13:54:20 +01:00
ipt_ECN.c net: Change pseudohdr argument of inet_proto_csum_replace* to be a bool 2015-08-17 21:33:06 -07:00
ipt_MASQUERADE.c netfilter: nat: add dependencies on conntrack module 2016-12-04 21:16:51 +01:00
ipt_REJECT.c netfilter: x_tables: move hook state into xt_action_param structure 2016-11-03 10:56:21 +01:00
ipt_SYNPROXY.c netfilter: SYNPROXY: skip non-tcp packet in {ipv4, ipv6}_synproxy_hook 2017-10-09 13:08:39 +02:00
ipt_ah.c netfilter: ipv4: whitespace around operators 2015-10-16 19:19:23 +02:00
ipt_rpfilter.c netfilter: rpfilter: fix incorrect loopback packet judgment 2017-01-16 14:23:01 +01:00
iptable_filter.c netfilter: remove defensive check on malformed packets from raw sockets 2018-01-08 18:11:04 +01:00
iptable_mangle.c netfilter: remove defensive check on malformed packets from raw sockets 2018-01-08 18:11:04 +01:00
iptable_nat.c netfilter: core: only allow one nat hook per hook point 2018-01-08 18:01:13 +01:00
iptable_raw.c netfilter: nf_defrag: mark xt_table structures 'const' again 2018-01-16 01:52:07 +01:00
iptable_security.c netfilter: remove defensive check on malformed packets from raw sockets 2018-01-08 18:11:04 +01:00
nf_conntrack_l3proto_ipv4.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf 2018-02-01 14:41:46 -05:00
nf_conntrack_proto_icmp.c netfilter: conntrack: timeouts can be const 2018-01-08 18:01:02 +01:00
nf_defrag_ipv4.c netfilter: nf_defrag: move NF_CONNTRACK bits into #ifdef 2018-01-16 01:52:08 +01:00
nf_dup_ipv4.c netfilter: kill the fake untracked conntrack objects 2017-04-15 11:47:57 +02:00
nf_flow_table_ipv4.c netfilter: nf_tables: fix flowtable free 2018-02-07 00:58:57 +01:00
nf_log_arp.c netfilter: constify nf_loginfo structures 2017-08-02 14:25:59 +02:00
nf_log_ipv4.c netfilter: constify nf_loginfo structures 2017-08-02 14:25:59 +02:00
nf_nat_h323.c netfilter: nf_nat_h323: fix logical-not-parentheses warning 2017-08-24 18:48:05 +02:00
nf_nat_l3proto_ipv4.c netfilter: remove defensive check on malformed packets from raw sockets 2018-01-08 18:11:04 +01:00
nf_nat_masquerade_ipv4.c net: Replace NF_CT_ASSERT() with WARN_ON(). 2017-09-04 13:25:19 +02:00
nf_nat_pptp.c netfilter: pptp: attach nat extension when needed 2017-04-26 09:30:22 +02:00
nf_nat_proto_gre.c netfilter: gre: Use consistent GRE and PTTP header structure instead of the ones defined by netfilter 2016-09-07 10:36:52 +02:00
nf_nat_proto_icmp.c net: Change pseudohdr argument of inet_proto_csum_replace* to be a bool 2015-08-17 21:33:06 -07:00
nf_nat_snmp_basic.asn1 netfilter: nf_nat_snmp_basic: use asn1 decoder library 2018-01-19 13:59:07 +01:00
nf_nat_snmp_basic_main.c netfilter: nf_nat_snmp_basic: use asn1 decoder library 2018-01-19 13:59:07 +01:00
nf_reject_ipv4.c netfilter: nf_reject_ipv4: Fix use-after-free in send_reset 2017-11-01 12:15:29 +01:00
nf_socket_ipv4.c netfilter: remove nf_ct_is_untracked 2017-04-15 11:51:33 +02:00
nf_tables_arp.c netfilter: nf_tables: get rid of struct nft_af_info abstraction 2018-01-10 15:32:11 +01:00
nf_tables_ipv4.c netfilter: nf_tables: get rid of struct nft_af_info abstraction 2018-01-10 15:32:11 +01:00
nft_chain_nat_ipv4.c netfilter: nf_tables: explicit nft_set_pktinfo() call from hook path 2018-01-08 18:01:15 +01:00
nft_chain_route_ipv4.c netfilter: remove defensive check on malformed packets from raw sockets 2018-01-08 18:11:04 +01:00
nft_dup_ipv4.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2016-11-15 10:54:36 -05:00
nft_fib_ipv4.c netfilter: nf_tables: fib: use skb_header_pointer 2017-07-31 19:01:39 +02:00
nft_masq_ipv4.c netfilter: nf_tables: fix mismatch in big-endian system 2017-03-13 13:30:28 +01:00
nft_redir_ipv4.c netfilter: nf_tables: fix mismatch in big-endian system 2017-03-13 13:30:28 +01:00
nft_reject_ipv4.c netfilter: nf_tables: use hook state from xt_action_param structure 2016-11-03 11:52:34 +01:00