Patrick McHardy 5397e97d75 [NETFILTER]: nf_conntrack: fix use-after-free in helper destroy callback invocation ... When the helper module is removed for a master connection that has a fulfilled expectation, but has already timed out and got removed from the hash tables, nf_conntrack_helper_unregister can't find the master connection to unset the helper, causing a use-after-free when the expected connection is destroyed and releases the last reference to the master. The helper destroy callback was introduced for the PPtP helper to clean up expectations and expected connections when the master connection times out, but doing this from destroy_conntrack only works for unfulfilled expectations since expected connections hold a reference to the master, preventing its destruction. Move the destroy callback to the timeout function, which fixes both problems. Reported/tested by Gabor Burjan <buga@buvoshetes.hu>. Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>		2007-05-19 14:23:52 -07:00
..
802	[NET]: cleanup extra semicolons	2007-04-25 22:29:24 -07:00
8021q	[NET]: Rework dev_base via list_head (v3)	2007-05-03 15:13:45 -07:00
appletalk	header cleaning: don't include smp_lock.h when not used	2007-05-08 11:15:07 -07:00
atm	[NET]: SPIN_LOCK_UNLOCKED cleanup in drivers/atm, net	2007-04-26 01:37:44 -07:00
ax25	[S390] Kconfig: unwanted menus for s390.	2007-05-10 15:46:07 +02:00
bluetooth	[BLUETOOTH]: Fix locking in hci_sock_dev_event().	2007-05-17 14:20:30 -07:00
bridge	header cleaning: don't include smp_lock.h when not used	2007-05-08 11:15:07 -07:00
core	[NET]: Fix net/core/skbuff.c gcc-3.2.3 compilation error	2007-05-19 13:55:25 -07:00
dccp	[NET]: SPIN_LOCK_UNLOCKED cleanup in drivers/atm, net	2007-04-26 01:37:44 -07:00
decnet	Fix occurrences of "the the "	2007-05-09 08:57:56 +02:00
econet	[SK_BUFF]: Convert skb->tail to sk_buff_data_t	2007-04-25 22:26:28 -07:00
ethernet	[SK_BUFF]: Introduce skb_reset_mac_header(skb)	2007-04-25 22:24:32 -07:00
ieee80211	[PATCH] ieee80211: include frequency in scan results	2007-05-08 11:51:59 -04:00
ipv4	[TCP] FRTO: Prevent state inconsistency in corner cases	2007-05-19 13:56:57 -07:00
ipv6	[IPV6]: Reverse sense of promisc tests in ip6_mc_input	2007-05-14 03:00:27 -07:00
ipx	Fix incorrect prototype for ipxrtr_route_packet()	2007-05-17 05:25:49 -07:00
irda	[S390] Kconfig: unwanted menus for s390.	2007-05-10 15:46:07 +02:00
iucv	Add suspend-related notifications for CPU hotplug	2007-05-09 12:30:56 -07:00
key	[IPSEC] pfkey: Load specific algorithm in pfkey_add rather than all	2007-05-19 14:21:18 -07:00
lapb	[PATCH] remove many unneeded #includes of sched.h	2007-02-14 08:09:54 -08:00
llc	Fix occurrences of "the the "	2007-05-09 08:57:56 +02:00
mac80211	[MAC80211]: include <linux/delay.h> instead of <asm/delay.h>	2007-05-10 23:45:09 -07:00
netfilter	[NETFILTER]: nf_conntrack: fix use-after-free in helper destroy callback invocation	2007-05-19 14:23:52 -07:00
netlabel	SELinux: extract the NetLabel SELinux support from the security server	2007-04-26 01:35:48 -04:00
netlink	header cleaning: don't include smp_lock.h when not used	2007-05-08 11:15:07 -07:00
netrom	[NET]: Rework dev_base via list_head (v3)	2007-05-03 15:13:45 -07:00
packet	[AF_PACKET]: Add option to return orig_dev to userspace.	2007-04-25 22:29:14 -07:00
rfkill	[RFKILL]: Fix check for correct rfkill allocation	2007-05-19 12:24:39 -07:00
rose	[NET]: Rework dev_base via list_head (v3)	2007-05-03 15:13:45 -07:00
rxrpc	AF_RXRPC: reduce debugging noise	2007-05-10 09:26:52 -07:00
sched	[NET_SCHED]: prio qdisc boundary condition	2007-05-14 02:57:19 -07:00
sctp	[SCTP]: Do not include ABORT chunk header in the notification.	2007-05-10 23:45:31 -07:00
sunrpc	Merge branch 'master' of /home/trondmy/repositories/git/linux-2.6/	2007-05-17 11:36:59 -04:00
tipc	Merge git://git.kernel.org/pub/scm/linux/kernel/git/sam/kbuild	2007-05-06 13:21:57 -07:00
unix	header cleaning: don't include smp_lock.h when not used	2007-05-08 11:15:07 -07:00
wanrouter	[SK_BUFF]: Introduce skb_copy_to_linear_data{_offset}	2007-04-25 22:28:29 -07:00
wireless	[WIRELESS] cfg80211: Clarify locking comment.	2007-04-26 20:51:12 -07:00
x25	header cleaning: don't include smp_lock.h when not used	2007-05-08 11:15:07 -07:00
xfrm	[IPSEC] pfkey: Load specific algorithm in pfkey_add rather than all	2007-05-19 14:21:18 -07:00
compat.c	[NET]: Adding SO_TIMESTAMPNS / SCM_TIMESTAMPNS support	2007-04-25 22:24:21 -07:00
Kconfig	[S390] Kconfig: no wireless on s390.	2007-05-10 15:46:08 +02:00
Makefile	[NET]: rfkill: add support for input key to control wireless radio	2007-05-07 00:34:20 -07:00
nonet.c	[PATCH] Make most file operations structs in fs/ const	2006-03-28 09:16:06 -08:00
socket.c	Remove SLAB_CTOR_CONSTRUCTOR	2007-05-17 05:23:04 -07:00
sysctl_net.c	Remove obsolete #include <linux/config.h>	2006-06-30 19:25:36 +02:00
TUNABLE