Sabrina Dubroca
ebfa00c574
tcp: fix refcnt leak with ebpf congestion control ...
There are a few bugs around refcnt handling in the new BPF congestion
control setsockopt:
- The new ca is assigned to icsk->icsk_ca_ops even in the case where we
cannot get a reference on it. This would lead to a use after free,
since that ca is going away soon.
- Changing the congestion control case doesn't release the refcnt on
the previous ca.
- In the reinit case, we first leak a reference on the old ca, then we
call tcp_reinit_congestion_control on the ca that we have just
assigned, leading to deinitializing the wrong ca (->release of the
new ca on the old ca's data) and releasing the refcount on the ca
that we actually want to use.
This is visible by building (for example) BIC as a module and setting
net.ipv4.tcp_congestion_control=bic, and using tcp_cong_kern.c from
samples/bpf.
This patch fixes the refcount issues, and moves reinit back into tcp
core to avoid passing a ca pointer back to BPF.
Fixes: 91b5b21c7c
2017-08-25 17:16:27 -07:00
9p: Implement show_options
2017-07-11 06:08:58 -04:00
Bluetooth: Set LE Default PHY preferences
2017-05-18 13:52:49 +02:00
scripts/spelling.txt: add "overide" pattern and fix typo instances
2017-03-09 17:01:09 -08:00
net: convert nf_bridge_info.use from atomic_t to refcount_t
2017-07-01 07:39:07 -07:00
tcp: Namespaceify sysctl_tcp_timestamps
2017-06-08 10:53:29 -04:00
NFC: Add nfc_dbg() macro
2017-04-05 10:15:20 +02:00
sctp: fix the check for _sctp_walk_params and _sctp_walk_errors
2017-07-27 00:03:12 -07:00
net: sched: introduce helper to identify gact trap action
2017-06-06 12:45:23 -04:00
6lowpan: Fix IID format for Bluetooth
2017-04-12 22:02:36 +02:00
net: sched: add termination action to allow goto chain
2017-05-17 15:22:13 -04:00
ipv6: fix NULL dereference in ip6_route_dev_notify()
2017-08-15 17:06:34 -07:00
rxrpc: Provide a cmsg to specify the amount of Tx data for a call
2017-06-07 17:15:46 +01:00
Now that IPC and other changes have landed, enable manual markings for
2017-07-19 08:55:18 -07:00
VSOCK: Add vsockmon tap functions
2017-04-24 12:35:56 -04:00
net: convert neighbour.refcnt from atomic_t to refcount_t
2017-07-01 07:39:07 -07:00
net, ax25: convert ax25_cb.refcount from atomic_t to refcount_t
2017-07-04 22:35:19 +01:00
bonding: Prevent duplicate userspace notification
2017-05-27 18:51:41 -04:00
bonding: require speed/duplex only for 802.3ad, alb and tlb
2017-08-11 14:21:42 -07:00
net: fix compilation when busy poll is not enabled
2017-08-11 14:59:24 -07:00
net, calipso: convert calipso_doi.refcount from atomic_t to refcount_t
2017-07-04 22:35:16 +01:00
nl80211: add authorized flag to ROAM event
2017-06-13 11:04:37 +02:00
csum: eliminate sparse warning in remcsum_unadjust()
2017-01-20 12:12:13 -05:00
net, ipv4: convert cipso_v4_doi.refcount from atomic_t to refcount_t
2017-07-04 01:29:04 -07:00
net/devlink: Add E-Switch encapsulation control
2017-04-22 20:26:37 +03:00
net, decnet: convert dn_fib_info.fib_clntref from atomic_t to refcount_t
2017-07-04 22:35:15 +01:00
net: dsa: Associate slave network device with CPU port
2017-06-13 16:35:03 -04:00
net: add debug atomic_inc_not_zero() in dst_hold()
2017-06-17 22:54:01 -04:00
net: store port/representator id in metadata_dst
2017-06-25 11:42:01 -04:00
net: add confirm_neigh method to dst_ops
2017-02-07 13:07:46 -05:00
esp6: Reorganize esp_output
2017-04-14 10:06:42 +02:00
net: convert fib_rule.refcnt from atomic_t to refcount_t
2017-07-01 07:39:09 -07:00
flowcache: make flow_key_size() return "unsigned int"
2017-04-03 19:04:48 -07:00
net/flow_dissector: add support for dissection of misc ip header fields
2017-06-04 18:12:23 -04:00
flowcache: more "unsigned int"
2017-04-03 19:04:48 -07:00
fq.h: Port memory limit mechanism from fq_codel
2016-09-30 13:29:21 +02:00
fq.h: Port memory limit mechanism from fq_codel
2016-09-30 13:29:21 +02:00
net_sched: gen_estimator: complete rewrite of rate estimators
2016-12-05 15:21:59 -05:00
genetlink: remove ops_list from genetlink header.
2017-06-05 10:54:55 -04:00
gro_cells: move to net/core/gro_cells.c
2017-02-08 14:38:18 -05:00
wireless: radiotap: rewrite the radiotap header file
2017-01-25 16:00:33 +01:00
net, ipv6: convert ifacaddr6.aca_refcnt from atomic_t to refcount_t
2017-07-04 01:29:04 -07:00
net: Introduce ife encapsulation module
2017-02-03 15:16:45 -05:00
inet: drop ->bind_conflict
2017-01-18 13:04:28 -05:00
net: Work around lockdep limitation in sockets that use sockets
2017-03-09 18:23:27 -08:00
tcp: ULP infrastructure
2017-06-15 12:12:40 -04:00
Merge branch 'for-4.13' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/percpu
2017-07-06 08:59:41 -07:00
net: make sk_ehashfn() static
2017-07-03 03:29:14 -07:00
net/tcp-fastopen: Add new API support
2017-01-25 14:04:38 -05:00
ipv4: Namespaceify tcp_tw_recycle and tcp_max_tw_buckets knob
2016-12-29 11:38:31 -05:00
net: convert inet_peer.refcnt from atomic_t to refcount_t
2017-07-01 07:39:07 -07:00
ipv4: better IP_MAX_MTU enforcement
2017-08-16 16:28:47 -07:00
ipv6: add rcu grace period before freeing fib6_node
2017-08-22 11:03:19 -07:00
net: ipv6: Compare lwstate in detecting duplicate nexthops
2017-07-06 10:48:01 +01:00
ip6_tunnel: Allow policy-based routing through tunnels
2017-04-21 13:21:30 -04:00
net, ipv4: convert fib_info.fib_clntref from atomic_t to refcount_t
2017-07-04 01:29:04 -07:00
ip_tunnel: Allow policy-based routing through tunnels
2017-04-21 13:21:31 -04:00
ipvs: remove unused function ip_vs_set_state_timeout
2017-04-28 12:00:10 +02:00
net, ipv6: convert ipv6_txoptions.refcnt from atomic_t to refcount_t
2017-07-04 01:29:03 -07:00
net, ipx: convert ipx_route.refcnt from atomic_t to refcount_t
2017-07-04 22:35:17 +01:00
wext: uninline stream addition functions
2017-01-13 09:38:42 +01:00
net: ipv4: Do not drop to make_route if oif is l3mdev
2016-10-13 12:05:26 -04:00
net, lapb: convert lapb_cb.refcnt from atomic_t to refcount_t
2017-07-04 22:35:16 +01:00
net, llc: convert llc_sap.refcnt from atomic_t to refcount_t
2017-07-04 22:35:15 +01:00
net: add extack arg to lwtunnel build state
2017-05-30 11:55:32 -04:00
mac80211: add api to start ba session timer expired flow
2017-08-09 09:49:42 +03:00
openvswitch: use mpls_hdr
2016-10-03 02:00:22 -04:00
net: mpls: Increase max number of labels for lwt encap
2017-04-01 20:21:44 -07:00
net/ncsi: Introduce ncsi_stop_dev()
2016-10-04 02:11:51 -04:00
net: convert neighbour.refcnt from atomic_t to refcount_t
2017-07-01 07:39:07 -07:00
Now that IPC and other changes have landed, enable manual markings for
2017-07-19 08:55:18 -07:00
Now that IPC and other changes have landed, enable manual markings for
2017-07-19 08:55:18 -07:00
net: convert netlbl_lsm_cache.refcount from atomic_t to refcount_t
2017-07-01 07:39:09 -07:00
netlink: correctly document nla_put_u64_64bit()
2017-07-13 09:26:27 -07:00
net, netrom: convert nr_node.refcount from atomic_t to refcount_t
2017-07-04 22:35:17 +01:00
sched: add helper for updating statistics on all actions
2017-05-31 17:58:13 -04:00
net: sched: move tc_classify function to cls_api.c
2017-05-17 15:22:13 -04:00
net: Add sysctl to toggle early demux for tcp and udp
2017-03-24 13:17:07 -07:00
net: Introduce psample, a new genetlink channel for packet sampling
2017-01-24 13:44:28 -05:00
net: ip, diag -- Add diag interface for raw sockets
2016-10-23 19:35:24 -04:00
net: ip, diag -- Add diag interface for raw sockets
2016-10-23 19:35:24 -04:00
ktime: Get rid of the union
2016-12-25 17:21:22 +01:00
net: convert sock.sk_refcnt from atomic_t to refcount_t
2017-07-01 07:39:08 -07:00
ipv4: call dst_hold_safe() properly
2017-06-17 22:54:00 -04:00
net: add netlink_ext_ack argument to rtnl_link_ops.slave_validate
2017-06-26 23:13:22 -04:00
net_sched: fix a refcount_t issue with noop_qdisc
2017-08-24 21:28:24 -07:00
sched/headers: Prepare to remove <linux/cred.h> inclusion from <linux/sched.h>
2017-03-02 08:42:31 +01:00
tcp: Namespaceify sysctl_tcp_timestamps
2017-06-08 10:53:29 -04:00
ipv6: sr: add core files for SR HMAC support
2016-11-09 20:40:06 -05:00
ipv6: sr: add core files for SR HMAC support
2016-11-09 20:40:06 -05:00
smc: netlink interface for SMC sockets
2017-01-09 16:07:41 -05:00
datagram: When peeking datagrams with offset < 0 don't skip empty skbs
2017-08-18 15:12:54 -07:00
net: switchdev: add SET_SWITCHDEV_OPS helper
2017-07-01 08:51:32 -07:00
tcp: fix refcnt leak with ebpf congestion control
2017-08-25 17:16:27 -07:00
tls: kernel TLS support
2017-06-15 12:12:40 -04:00
udp: fix linear skb reception with PEEK_OFF
2017-08-14 22:26:51 -07:00
udp: use a separate rx queue for packet reception
2017-05-16 15:41:29 -04:00
net, vxlan: convert vxlan_sock.refcnt from atomic_t to refcount_t
2017-07-04 22:35:15 +01:00
dev_ioctl: copy only the smaller struct iwreq for wext
2017-06-14 13:52:44 +02:00
net, x25: convert x25_neigh.refcnt from atomic_t to refcount_t
2017-07-04 22:35:18 +01:00
net, xfrm: convert sec_path.refcnt from atomic_t to refcount_t
2017-07-04 22:35:18 +01:00
ebfa00c574