Eric Dumazet 97599dc792 net: drop dst before queueing fragments ... Commit 4a94445c9a (net: Use ip_route_input_noref() in input path) added a bug in IP defragmentation handling, as non refcounted dst could escape an RCU protected section. Commit 64f3b9e203 (net: ip_expire() must revalidate route) fixed the case of timeouts, but not the general problem. Tom Parkin noticed crashes in UDP stack and provided a patch, but further analysis permitted us to pinpoint the root cause. Before queueing a packet into a frag list, we must drop its dst, as this dst has limited lifetime (RCU protected) When/if a packet is finally reassembled, we use the dst of the very last skb, still protected by RCU and valid, as the dst of the reassembled packet. Use same logic in IPv6, as there is no need to hold dst references. Reported-by: Tom Parkin <tparkin@katalix.com> Tested-by: Tom Parkin <tparkin@katalix.com> Signed-off-by: Eric Dumazet <edumazet@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>		2013-04-17 01:15:29 -04:00
..
netfilter	netfilter: ip6t_NPT: Fix translation for non-multiple of 32 prefix lengths	2013-04-03 12:24:56 +02:00
addrconf_core.c	ipv6: statically link register_inet6addr_notifier()	2013-04-14 15:24:17 -04:00
addrconf.c	ipv6: statically link register_inet6addr_notifier()	2013-04-14 15:24:17 -04:00
addrlabel.c	hlist: drop the node parameter from iterators	2013-02-27 19:10:24 -08:00
af_inet6.c	ipv6: Use FIELD_SIZEOF() in inet6_init().	2013-01-09 23:38:23 -08:00
ah6.c	net: Add skb_unclone() helper function.	2013-02-15 15:10:37 -05:00
anycast.c	net: proc: change proc_net_remove to remove_proc_entry	2013-02-18 14:53:08 -05:00
datagram.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2013-02-05 14:12:20 -05:00
esp6.c	ah6/esp6: set transport header correctly for IPsec tunnel mode.	2013-01-08 12:41:30 +01:00
exthdrs_core.c	Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/jesse/openvswitch	2012-11-30 12:01:30 -05:00
exthdrs_offload.c	ipv6: Pull IPv6 GSO registration out of the module	2012-11-15 17:39:24 -05:00
exthdrs.c	ipv6: Store Router Alert option in IP6CB directly.	2013-01-13 20:17:14 -05:00
fib6_rules.c	ipv6: introduce ip6_rt_put()	2012-11-03 14:59:05 -04:00
icmp.c	ipv6: Add an error handler for icmp6	2013-01-18 14:19:42 -05:00
inet6_connection_sock.c	hlist: drop the node parameter from iterators	2013-02-27 19:10:24 -08:00
inet6_hashtables.c	soreuseport: TCP/IPv6 implementation	2013-01-23 13:44:01 -05:00
ip6_checksum.c	ipv6: move csum_ipv6_magic() and udp6_csum_init() into static library	2013-01-08 17:56:10 -08:00
ip6_fib.c	hlist: drop the node parameter from iterators	2013-02-27 19:10:24 -08:00
ip6_flowlabel.c	net: proc: change proc_net_remove to remove_proc_entry	2013-02-18 14:53:08 -05:00
ip6_gre.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2013-02-08 18:02:14 -05:00
ip6_input.c	ipv6: don't accept node local multicast traffic from the wire	2013-03-29 14:57:33 -04:00
ip6_offload.c	v4 GRE: Add TCP segmentation offload for GRE	2013-02-15 15:17:11 -05:00
ip6_offload.h	ipv6: Pull IPv6 GSO registration out of the module	2012-11-15 17:39:24 -05:00
ip6_output.c	ipv6: don't let node/interface scoped multicast traffic escape on the wire	2013-02-11 14:00:54 -05:00
ip6_tunnel.c	ipv6: Introduce ip6_flow_hdr() to fill version, tclass and flowlabel.	2013-01-13 20:17:13 -05:00
ip6mr.c	net: proc: change proc_net_remove to remove_proc_entry	2013-02-18 14:53:08 -05:00
ipcomp6.c
ipv6_sockglue.c	ipv6: rename datagram_send_ctl and datagram_recv_ctl	2013-01-31 13:53:08 -05:00
Kconfig	Merge branch 'akpm' (incoming from Andrew)	2013-02-21 17:38:49 -08:00
Makefile	ipv6: move csum_ipv6_magic() and udp6_csum_init() into static library	2013-01-08 17:56:10 -08:00
mcast.c	net: proc: change proc_net_remove to remove_proc_entry	2013-02-18 14:53:08 -05:00
mip6.c	ipv6: mip6: fix mip6_mh_filter()	2012-09-25 16:04:44 -04:00
ndisc.c	ndisc: Use compound literals to build redirect message.	2013-01-21 13:33:18 -05:00
netfilter.c	netfilter: ipv6: expand skb head in ip6_route_me_harder after oif change	2012-08-30 03:00:15 +02:00
output_core.c	ipv6: Update ipv6 static library with newly needed functions	2012-11-15 17:39:23 -05:00
proc.c	net: proc: change proc_net_remove to remove_proc_entry	2013-02-18 14:53:08 -05:00
protocol.c	ipv6: Pull IPv6 GSO registration out of the module	2012-11-15 17:39:24 -05:00
raw.c	hlist: drop the node parameter from iterators	2013-02-27 19:10:24 -08:00
reassembly.c	net: drop dst before queueing fragments	2013-04-17 01:15:29 -04:00
route.c	net: ipv6: Don't purge default router if accept_ra=2	2013-03-04 14:12:07 -05:00
sit.c	ipv6: add anti-spoofing checks for 6to4 and 6rd	2013-01-29 15:22:03 -05:00
syncookies.c	tcp: make sysctl_tcp_ecn namespace aware	2013-01-06 21:09:56 -08:00
sysctl_net_ipv6.c	net: Enable some sysctls that are safe for the userns root	2012-11-18 20:33:00 -05:00
tcp_ipv6.c	ipv6/tcp: Stop processing ICMPv6 redirect messages	2013-04-07 12:36:08 -04:00
tcpv6_offload.c	net: Remove code duplication between offload structures	2012-11-15 17:39:51 -05:00
tunnel6.c
udp_impl.h
udp_offload.c	v4 GRE: Add TCP segmentation offload for GRE	2013-02-15 15:17:11 -05:00
udp.c	udp: add encap_destroy callback	2013-03-20 12:10:38 -04:00
udplite.c
xfrm6_input.c
xfrm6_mode_beet.c
xfrm6_mode_ro.c
xfrm6_mode_transport.c
xfrm6_mode_tunnel.c	ipv6: fix warning in xfrm6_mode_tunnel_input	2013-02-18 12:42:47 -05:00
xfrm6_output.c
xfrm6_policy.c	xfrm: release neighbor upon dst destruction	2013-02-18 14:57:29 -05:00
xfrm6_state.c	ipv6: use IS_ENABLED()	2012-11-01 12:41:35 -04:00
xfrm6_tunnel.c	hlist: drop the node parameter from iterators	2013-02-27 19:10:24 -08:00