From: Luis Henriques <luis.henriques@canonical.com>
To: David Miller <davem@davemloft.net>
Cc: nicolas.dichtel@6wind.com, netdev@vger.kernel.org,
gregkh@linuxfoundation.org, rostedt@goodmis.org,
linux-kernel@vger.kernel.org, stable@vger.kernel.org,
williams@redhat.com, linux-rt-users@vger.kernel.org,
lclaudio@uudg.org
Subject: Re: [PATCH linux-3.10.y] ip6tnl: fix use after free of fb_tnl_dev
Date: Thu, 19 Dec 2013 10:07:52 +0000 [thread overview]
Message-ID: <20131219100752.GA3866@hercules> (raw)
In-Reply-To: <20131217.144002.1716319550180883592.davem@davemloft.net>
On Tue, Dec 17, 2013 at 02:40:02PM -0500, David Miller wrote:
> From: Nicolas Dichtel <nicolas.dichtel@6wind.com>
> Date: Fri, 13 Dec 2013 10:06:35 +0100
>
> > The upstream commit bb8140947a24 ("ip6tnl: allow to use rtnl ops on fb tunnel")
> > (backported into linux-3.10.y) left a bug which was fixed upstream by commit
> > 1e9f3d6f1c40 ("ip6tnl: fix use after free of fb_tnl_dev").
> >
> > The problem is a bit different in linux-3.10.y, because there is no x-netns
> > support (upstream commit 0bd8762824e7 ("ip6tnl: add x-netns support")).
> > When ip6_tunnel.ko is unloaded, FB device is deleted by rtnl_link_unregister()
> > and then we try to delete it again in ip6_tnl_destroy_tunnels().
> >
> > This patch removes the second deletion.
> >
> > Reported-by: Steven Rostedt <rostedt@goodmis.org>
> > Suggested-by: Steven Rostedt <rostedt@goodmis.org>
> > Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
>
> Greg please queue this up for 3.10 -stable if you haven't already.
As I'm picking the networking patches into the 3.11 kernel as well, I
believe this fix is also applicable. I'm queuing it for the 3.11 kernel.
Cheers,
--
Luis
>
> Thanks a lot.
> --
> To unsubscribe from this list: send the line "unsubscribe stable" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at http://vger.kernel.org/majordomo-info.html
next prev parent reply other threads:[~2013-12-19 10:07 UTC|newest]
Thread overview: 18+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-11-14 2:14 [BUG] stable v3.10.16+ introduced by "ip6tnl: allow to use rtnl ops on fb tunnel" Steven Rostedt
2013-11-14 14:47 ` [PATCH net] ip6tnl: fix use after free of fb_tnl_dev Nicolas Dichtel
2013-11-14 15:40 ` Willem de Bruijn
2013-11-14 22:05 ` David Miller
2013-11-14 22:18 ` Steven Rostedt
2013-12-09 0:25 ` [BUG] stable v3.10.16+ introduced by "ip6tnl: allow to use rtnl ops on fb tunnel" Greg Kroah-Hartman
2013-12-09 14:48 ` Steven Rostedt
2013-12-09 14:54 ` Steven Rostedt
2013-12-11 21:53 ` David Miller
2013-12-12 9:53 ` Nicolas Dichtel
2013-12-12 9:53 ` Nicolas Dichtel
2013-12-12 20:35 ` David Miller
2013-12-13 9:06 ` [PATCH linux-3.10.y] ip6tnl: fix use after free of fb_tnl_dev Nicolas Dichtel
2013-12-17 19:40 ` David Miller
2013-12-17 19:54 ` Greg KH
2013-12-19 10:07 ` Luis Henriques [this message]
2013-12-19 10:23 ` Nicolas Dichtel
2013-12-19 10:23 ` Nicolas Dichtel
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20131219100752.GA3866@hercules \
--to=luis.henriques@canonical.com \
--cc=davem@davemloft.net \
--cc=gregkh@linuxfoundation.org \
--cc=lclaudio@uudg.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-rt-users@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=nicolas.dichtel@6wind.com \
--cc=rostedt@goodmis.org \
--cc=stable@vger.kernel.org \
--cc=williams@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.