Thomas Graf c58dd2dd44 netfilter: Can't fail and free after table replacement ... All xtables variants suffer from the defect that the copy_to_user() to copy the counters to user memory may fail after the table has already been exchanged and thus exposed. Return an error at this point will result in freeing the already exposed table. Any subsequent packet processing will result in a kernel panic. We can't copy the counters before exposing the new tables as we want provide the counter state after the old table has been unhooked. Therefore convert this into a silent error. Cc: Florian Westphal <fw@strlen.de> Signed-off-by: Thomas Graf <tgraf@suug.ch> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>		2014-04-05 17:46:22 +02:00
..
Kconfig	netfilter: nft_reject: split up reject module into IPv4 and IPv6 specifc parts	2014-02-06 09:44:10 +01:00
Makefile	netfilter: nft_reject: split up reject module into IPv4 and IPv6 specifc parts	2014-02-06 09:44:10 +01:00
arp_tables.c	netfilter: Can't fail and free after table replacement	2014-04-05 17:46:22 +02:00
arpt_mangle.c	netfilter: arpt_mangle: fix return values of checkentry	2011-02-01 16:03:46 +01:00
arptable_filter.c	netfilter: pass hook ops to hookfn	2013-10-14 11:29:31 +02:00
ip_tables.c	netfilter: Can't fail and free after table replacement	2014-04-05 17:46:22 +02:00
ipt_CLUSTERIP.c	Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next	2013-11-04 19:46:58 -05:00
ipt_ECN.c	netfilter: xtables: substitute temporary defines by final name	2010-05-11 18:31:17 +02:00
ipt_MASQUERADE.c	netfilter: nf_conntrack: don't send destroy events from iterator	2013-08-09 12:03:33 +02:00
ipt_REJECT.c	netfilter: REJECT: separate reusable code	2013-12-30 15:04:41 +01:00
ipt_SYNPROXY.c	netfilter: SYNPROXY target: restrict to INPUT/FORWARD	2013-12-11 11:30:25 +01:00
ipt_ULOG.c	netfilter: ipt_ULOG: fix info leaks	2013-10-02 17:28:36 +02:00
ipt_ah.c	netfilter: xtables: change hotdrop pointer to direct modification	2010-05-11 18:35:27 +02:00
ipt_rpfilter.c	netfilter: xt_rpfilter: skip locally generated broadcast/multicast, too	2013-04-19 00:11:59 +02:00
iptable_filter.c	netfilter: pass hook ops to hookfn	2013-10-14 11:29:31 +02:00
iptable_mangle.c	netfilter: pass hook ops to hookfn	2013-10-14 11:29:31 +02:00
iptable_nat.c	netfilter: pass hook ops to hookfn	2013-10-14 11:29:31 +02:00
iptable_raw.c	netfilter: pass hook ops to hookfn	2013-10-14 11:29:31 +02:00
iptable_security.c	netfilter: pass hook ops to hookfn	2013-10-14 11:29:31 +02:00
nf_conntrack_l3proto_ipv4.c	netfilter: nf_conntrack: remove dead code	2014-01-03 23:41:37 +01:00
nf_conntrack_l3proto_ipv4_compat.c	netfilter: add my copyright statements	2013-04-18 20:27:55 +02:00
nf_conntrack_proto_icmp.c	netfilter: add my copyright statements	2013-04-18 20:27:55 +02:00
nf_defrag_ipv4.c	netfilter: pass hook ops to hookfn	2013-10-14 11:29:31 +02:00
nf_nat_h323.c	netfilter: nf_nat_h323: fix crash in nf_ct_unlink_expect_report()	2014-02-05 17:46:05 +01:00
nf_nat_l3proto_ipv4.c	netfilter: add protocol independent NAT core	2012-08-30 03:00:14 +02:00
nf_nat_pptp.c	netfilter: add my copyright statements	2013-04-18 20:27:55 +02:00
nf_nat_proto_gre.c	netfilter: add my copyright statements	2013-04-18 20:27:55 +02:00
nf_nat_proto_icmp.c	netfilter: add protocol independent NAT core	2012-08-30 03:00:14 +02:00
nf_nat_snmp_basic.c	netfilter: nf_nat_snmp_basic: fix duplicates in if/else branches	2014-02-14 11:37:36 +01:00
nf_tables_arp.c	netfilter: nf_tables: rename nft_do_chain_pktinfo() to nft_do_chain()	2014-01-09 20:17:16 +01:00
nf_tables_ipv4.c	netfilter: nf_tables: fix error path in the init functions	2014-01-09 23:25:48 +01:00
nft_chain_nat_ipv4.c	netfilter: nf_tables: rename nft_do_chain_pktinfo() to nft_do_chain()	2014-01-09 20:17:16 +01:00
nft_chain_route_ipv4.c	netfilter: nf_tables: rename nft_do_chain_pktinfo() to nft_do_chain()	2014-01-09 20:17:16 +01:00
nft_reject_ipv4.c	netfilter: nf_tables: add reject module for NFPROTO_INET	2014-02-06 09:44:18 +01:00