Home Home > GIT Browse
summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorDenis Kirjanov <dkirjanov@suse.com>2019-05-02 13:49:28 +0200
committerDenis Kirjanov <dkirjanov@suse.com>2019-05-02 13:49:34 +0200
commite39197c088f4ef2a7a330424a871efac7687272d (patch)
tree47fcd964d2eb1cfbe42120f2af1bde342b56ee78
parentafb61f8f3019c8f8b9ab2d1b38a1715d9abd0aa4 (diff)
netfilter: ipset: Missing nfnl_lock()/nfnl_unlock() is added
to ip_set_net_exit() (git-fixes).
-rw-r--r--patches.fixes/0002-netfilter-ipset-Missing-nfnl_lock-nfnl_unlock-is-add.patch41
-rw-r--r--series.conf1
2 files changed, 42 insertions, 0 deletions
diff --git a/patches.fixes/0002-netfilter-ipset-Missing-nfnl_lock-nfnl_unlock-is-add.patch b/patches.fixes/0002-netfilter-ipset-Missing-nfnl_lock-nfnl_unlock-is-add.patch
new file mode 100644
index 0000000000..93de22bb68
--- /dev/null
+++ b/patches.fixes/0002-netfilter-ipset-Missing-nfnl_lock-nfnl_unlock-is-add.patch
@@ -0,0 +1,41 @@
+From: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
+Subject: netfilter: ipset: Missing nfnl_lock()/nfnl_unlock() is
+ added to ip_set_net_exit()
+Patch-mainline: v4.16-rc1
+Git-commit: f998b6b10144cd9809da6af02758615f789e8aa1
+References: git-fixes
+
+Patch "netfilter: ipset: use nfnl_mutex_is_locked" is added the real
+mutex locking check, which revealed the missing locking in ip_set_net_exit().
+
+Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
+Reported-by: syzbot+36b06f219f2439fe62e1@syzkaller.appspotmail.com
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Acked-by: Denis Kirjanov <dkirjanov@suse.com>
+---
+ net/netfilter/ipset/ip_set_core.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/net/netfilter/ipset/ip_set_core.c b/net/netfilter/ipset/ip_set_core.c
+index 37345feb43fc..74304b44b8c5 100644
+--- a/net/netfilter/ipset/ip_set_core.c
++++ b/net/netfilter/ipset/ip_set_core.c
+@@ -2039,6 +2039,7 @@ ip_set_net_exit(struct net *net)
+
+ inst->is_deleted = true; /* flag for ip_set_nfnl_put */
+
++ nfnl_lock(NFNL_SUBSYS_IPSET);
+ for (i = 0; i < inst->ip_set_max; i++) {
+ set = ip_set(inst, i);
+ if (set) {
+@@ -2046,6 +2047,7 @@ ip_set_net_exit(struct net *net)
+ ip_set_destroy_set(set);
+ }
+ }
++ nfnl_unlock(NFNL_SUBSYS_IPSET);
+ kfree(rcu_dereference_protected(inst->ip_set_list, 1));
+ }
+
+--
+2.12.3
+
diff --git a/series.conf b/series.conf
index 5dda07dae3..ec55c7cb76 100644
--- a/series.conf
+++ b/series.conf
@@ -12409,6 +12409,7 @@
patches.drivers/net-hns3-fix-for-not-setting-pause-parameters.patch
patches.drivers/net-hns3-remove-redundant-semicolon.patch
patches.drivers/net-hns3-Add-more-packet-size-statisctics.patch
+ patches.fixes/0002-netfilter-ipset-Missing-nfnl_lock-nfnl_unlock-is-add.patch
patches.drivers/ixgbe-enable-multicast-on-shutdown-for-WOL.patch
patches.drivers/ixgbe-remove-unused-enum-latency_range.patch
patches.drivers/ixgbe-advertise-highest-capable-link-speed.patch