Tho Vu a5839b6b3a ravb: Fix use-after-free ravb_tstamp_skb ... [ Upstream commit cfef46d692 ] When a Tx timestamp is requested, a pointer to the skb is stored in the ravb_tstamp_skb struct. This was done without an skb_get. There exists the possibility that the skb could be freed by ravb_tx_free (when ravb_tx_free is called from ravb_start_xmit) before the timestamp was processed, leading to a use-after-free bug. Use skb_get when filling a ravb_tstamp_skb struct, and add appropriate frees/consumes when a ravb_tstamp_skb struct is freed. Fixes: c156633f13 ("Renesas Ethernet AVB driver proper") Signed-off-by: Tho Vu <tho.vu.wh@rvc.renesas.com> Signed-off-by: Kazuya Mizuguchi <kazuya.mizuguchi.ks@renesas.com> Signed-off-by: Simon Horman <horms+renesas@verge.net.au> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Sasha Levin <sashal@kernel.org>		2019-09-10 10:33:48 +01:00
..
appletalk	net/appletalk: fix minor pointer leak to userspace in SIOCFINDIPDDPRT	2018-09-13 10:35:57 -07:00
arcnet
bonding	bonding: Force slave speed check after link state recovery for 802.3ad	2019-08-29 08:28:28 +02:00
caif	caif-hsi: fix possible deadlock in cfhsi_exit_module()	2019-07-28 08:29:23 +02:00
can	can: peak_usb: force the string buffer NULL-terminated	2019-08-29 08:28:38 +02:00
dsa	net: dsa: mv88e6xxx: wait after reset deactivation	2019-07-28 08:29:24 +02:00
ethernet	ravb: Fix use-after-free ravb_tstamp_skb	2019-09-10 10:33:48 +01:00
fddi	net: fddi: fix a possible null-ptr-deref	2018-06-08 18:47:46 -04:00
fjes	fjes: use currently unused variable my_epid and max_epid	2018-07-05 19:34:21 +09:00
hamradio	net/hamradio/6pack: use mod_timer() to rearm timers	2019-01-09 17:38:32 +01:00
hippi	treewide: kmalloc() -> kmalloc_array()	2018-06-12 16:19:22 -07:00
hyperv	hv_netvsc: Fix a warning of suspicious RCU usage	2019-09-10 10:33:43 +01:00
ieee802154	net: ieee802154: fix missing checks for regmap_update_bits	2019-05-25 18:23:43 +02:00
ipvlan	net: ipvlan: Fix ipvlan device tso disabled while NETIF_F_IP_CSUM is set	2019-06-25 11:35:58 +08:00
netdevsim	Merge ra.kernel.org:/pub/scm/linux/kernel/git/davem/net	2018-08-02 10:55:32 -07:00
phy	net: phy: phy_led_triggers: Fix a possible null-pointer dereference in phy_led_trigger_change_speed()	2019-08-29 08:28:36 +02:00
plip
ppp	compat_ioctl: pppoe: fix PPPOEIOCSFWD handling	2019-08-09 17:52:34 +02:00
slip	slip: make slhc_free() silently accept an error pointer	2019-05-02 09:58:56 +02:00
team	team: Add vlan tx offload to hw_enc_features	2019-08-25 10:48:04 +02:00
usb	net: kalmia: fix memory leaks	2019-09-10 10:33:48 +01:00
vmxnet3
wan	net/wan: fix a double free in x25_asy_open_tty()	2019-01-09 17:38:32 +01:00
wimax	wimax/i2400m: fix a memory leak bug	2019-09-10 10:33:48 +01:00
wireless	mt76: mt76x0u: do not reset radio on resume	2019-09-06 10:22:23 +02:00
xen-netback	xen/netback: Reset nr_frags before freeing skb	2019-08-25 10:48:05 +02:00
dummy.c
eql.c
geneve.c	geneve: correctly handle ipv6.disable module parameter	2019-03-10 07:17:17 +01:00
gtp.c	gtp: fix use-after-free in gtp_newlink()	2019-07-26 09:14:17 +02:00
ifb.c
Kconfig	gtp: change NET_UDP_TUNNEL dependency to select	2019-04-03 06:26:15 +02:00
LICENSE.SRC
loopback.c	net: loopback: clear skb->tstamp before netif_rx()	2018-11-13 11:08:20 -08:00
macsec.c	macsec: fix checksumming after decryption	2019-07-28 08:29:26 +02:00
macvlan.c	macvlan: return correct error value	2018-12-21 14:15:20 +01:00
macvtap.c
Makefile	net: Always descend into dsa/	2019-05-25 18:23:19 +02:00
mdio.c
mii.c
net_failover.c	failover: Add missing check to validate 'slave_dev' in net_failover_slave_unregister	2018-11-13 11:08:28 -08:00
netconsole.c
nlmon.c
ntb_netdev.c	net: drivers/net: Convert random_ether_addr to eth_random_addr	2018-06-23 10:49:14 +09:00
rionet.c	rapidio/rionet: do not free skb before reading its length	2018-12-05 19:31:59 +01:00
sb1000.c
Space.c
sungem_phy.c
tap.c	net: in virtio_net_hdr only add VLAN_HLEN to csum_start if payload holds vlan	2018-06-07 16:15:38 -04:00
thunderbolt.c	net: thunderbolt: Unregister ThunderboltIP protocol handler when suspending	2019-06-15 11:54:07 +02:00
tun.c	tun: mark small packets as owned by the tap sock	2019-08-09 17:52:33 +02:00
veth.c	veth: Orphan skb before GRO	2018-09-16 15:33:50 -07:00
virtio_net.c	virtio_net: Account for tx bytes and packets on sending xdp_frames	2019-02-12 19:47:23 +01:00
vrf.c	vrf: make sure skb->data contains ip header to make routing	2019-07-28 08:29:26 +02:00
vsockmon.c
vxlan.c	vxlan: Don't call gro_cells_destroy() before device is unregistered	2019-04-03 06:26:18 +02:00
xen-netfront.c	xen/netfront: tolerate frags with no data	2019-01-09 17:38:34 +01:00