David Ahern 56f8ae4e07 vrf: Fix use after free and double free in vrf_finish_output ... commit 82dd0d2a9a upstream. Miguel reported an skb use after free / double free in vrf_finish_output when neigh_output returns an error. The vrf driver should return after the call to neigh_output as it takes over the skb on error path as well. Patch is a simplified version of Miguel's patch which was written for 4.9, and updated to top of tree. Fixes: 8f58336d3f ("net: Add ethernet header for pass through VRF device") Signed-off-by: Miguel Fadon Perlines <mfadon@teldat.com> Signed-off-by: David Ahern <dsahern@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net> [ backport to 4.4 and 4.9 dropped the sock_confirm_neigh and changed neigh_output to dst_neigh_output ] Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2018-04-13 19:50:27 +02:00
..
appletalk	net/appletalk: Fix kernel memory disclosure	2017-12-09 18:42:42 +01:00
arcnet
bonding	bonding: process the err returned by dev_set_allmulti properly in bond_enslave	2018-04-13 19:50:26 +02:00
caif	net: caif: check return value of alloc_netdev	2015-11-09 11:31:13 -05:00
can	can: cc770: Fix use after free in cc770_tx_interrupt()	2018-03-28 18:40:16 +02:00
cris
dsa	net: dsa: bcm_sf2: Ensure we re-negotiate EEE during after link change	2016-12-10 19:07:23 +01:00
ethernet	r8169: fix setting driver_data after register_netdev	2018-04-13 19:50:27 +02:00
fddi
fjes	fjes: Fix wrong netdevice feature flags	2017-12-20 10:04:55 +01:00
hamradio	hdlcdrv: Fix divide by zero in hdlcdrv_ioctl	2018-04-13 19:50:14 +02:00
hippi	hippi: Fix a Fix a possible sleep-in-atomic bug in rr_close	2018-02-25 11:03:42 +01:00
hyperv	hv_netvsc: use skb_get_hash() instead of a homegrown implementation	2017-03-26 12:13:18 +02:00
ieee802154	fakelb: fix schedule while atomic	2017-03-15 09:57:15 +08:00
ipvlan	ipvlan: add L2 check for packets arriving via virtual devices	2018-03-22 09:23:30 +01:00
irda	irda: vlsi_ir: fix check for DMA mapping errors	2017-12-25 14:22:12 +01:00
phy	net: phy: avoid genphy_aneg_done() for PHYs without clause 22 support	2018-04-13 19:50:18 +02:00
plip
ppp	pptp: remove a buggy dst release in pptp_connect()	2018-04-13 19:50:25 +02:00
slip
team	team: Fix double free in error path	2018-03-31 18:12:34 +02:00
usb	net: cdc_ncm: Fix TX zero padding	2018-04-13 19:50:02 +02:00
vmxnet3	vmxnet3: ensure that adapter is in proper state during force_close	2018-04-13 19:50:04 +02:00
wan	wan: pc300too: abort path on failure	2018-03-24 10:58:43 +01:00
wimax	net: wimax/i2400m: fix NULL-deref at probe	2017-12-20 10:04:54 +01:00
wireless	wl1251: check return from call to wl1251_acx_arp_ip_filter	2018-04-13 19:50:14 +02:00
xen-netback	xen/netback: set default upper limit of tx/rx queues to 8	2017-11-15 17:13:09 +01:00
dummy.c
eql.c
geneve.c	geneve: avoid use-after-free of skb->data	2016-12-10 19:07:24 +01:00
ifb.c
Kconfig	vmxnet3: prevent building with 64K pages	2018-02-25 11:03:42 +01:00
LICENSE.SRC
loopback.c	net: introduce device min_header_len	2017-02-18 16:39:27 +01:00
macvlan.c	macvlan: Only deliver one copy of the frame to the macvlan interface	2017-12-20 10:05:01 +01:00
macvtap.c	tun/tap: sanitize TUNSETSNDBUF input	2017-11-18 11:11:05 +01:00
Makefile
mdio.c
mii.c
netconsole.c
nlmon.c
ntb_netdev.c
rionet.c	rapidio/rionet: fix deadlock on SMP	2016-04-12 09:08:58 -07:00
sb1000.c
Space.c
sungem_phy.c
tun.c	tun: allow positive return values on dev_get_valid_name() call	2017-11-18 11:11:06 +01:00
veth.c	veth: set peer GSO values	2018-03-22 09:23:29 +01:00
virtio_net.c	virtio_net: check return value of skb_to_sgvec in one more location	2018-04-13 19:50:23 +02:00
vrf.c	vrf: Fix use after free and double free in vrf_finish_output	2018-04-13 19:50:27 +02:00
vxlan.c	vxlan: dont migrate permanent fdb entries during learn	2018-04-13 19:50:21 +02:00
xen-netfront.c	xen-netfront: enable device after manual module load	2018-03-03 10:19:45 +01:00