David Ahern e671f1cc58 vrf: Fix use-after-free in vrf_xmit ... [ Upstream commit f7887d40e5 ] KASAN detected a use-after-free: [ 269.467067] BUG: KASAN: use-after-free in vrf_xmit+0x7f1/0x827 [vrf] at addr ffff8800350a21c0 [ 269.467067] Read of size 4 by task ssh/1879 [ 269.467067] CPU: 1 PID: 1879 Comm: ssh Not tainted 4.10.0+ #249 [ 269.467067] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.7.5-20140531_083030-gandalf 04/01/2014 [ 269.467067] Call Trace: [ 269.467067] dump_stack+0x81/0xb6 [ 269.467067] kasan_object_err+0x21/0x78 [ 269.467067] kasan_report+0x2f7/0x450 [ 269.467067] ? vrf_xmit+0x7f1/0x827 [vrf] [ 269.467067] ? ip_output+0xa4/0xdb [ 269.467067] __asan_load4+0x6b/0x6d [ 269.467067] vrf_xmit+0x7f1/0x827 [vrf] ... Which corresponds to the skb access after xmit handling. Fix by saving skb->len and using the saved value to update stats. Fixes: 193125dbd8 ("net: Introduce VRF device driver") Signed-off-by: David Ahern <dsa@cumulusnetworks.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2017-03-22 12:04:16 +01:00
..
accessibility
acpi	nfit, libnvdimm: fix interleave set cookie calculation	2017-03-18 19:09:58 +08:00
amba
android	ANDROID: binder: Clear binder and cookie when setting handle in flat binder struct	2016-11-10 16:36:33 +01:00
ata	libata: apply MAX_SEC_1024 to all CX1-JB*-HP devices	2017-02-09 08:02:45 +01:00
atm
auxdisplay
base	base/memory, hotplug: fix a kernel oops in show_valid_zones()	2017-02-09 08:02:47 +01:00
bcma	bcma: use (get|put)_device when probing/removing device driver	2017-03-12 06:37:30 +01:00
block	loop: fix LO_FLAGS_PARTSCAN hang	2017-03-12 06:37:27 +01:00
bluetooth	Bluetooth: Add another AR3012 04ca:3018 device	2017-03-15 09:57:11 +08:00
bus	bus: vexpress-config: fix device reference leak	2017-01-19 20:17:22 +01:00
cdrom
char	tpm xen: Remove bogus tpm_chip_unregister	2017-01-06 11:16:16 +01:00
clk	clk: imx31: fix rewritten input argument of mx31_clocks_init()	2017-01-12 11:22:49 +01:00
clocksource	clocksource/exynos_mct: Clear interrupt when cpu is shut down	2017-01-26 08:23:48 +01:00
connector	connector: bump skb->users before callback invocation	2016-01-04 21:46:45 -05:00
cpufreq	cpufreq: powernv: Disable preemption while checking CPU throttling state	2017-01-19 20:17:22 +01:00
cpuidle	ARM: cpuidle: Fix error return code	2016-10-16 17:36:15 +02:00
crypto	crypto: caam - fix AEAD givenc descriptors	2017-01-06 11:16:12 +01:00
dca
devfreq
dio
dma	dmaengine: ipu: Make sure the interrupt routine checks all interrupts.	2017-03-12 06:37:30 +01:00
dma-buf
edac	EDAC: Increment correct counter in edac_inc_ue_error()	2016-09-07 08:32:41 +02:00
eisa
extcon	extcon: max77843: Use correct size for reading the interrupt register	2016-05-04 14:48:54 -07:00
firewire	firewire: net: fix fragmented datagram_size off-by-one	2016-11-10 16:36:35 +01:00
firmware	efi: Expose non-blocking set_variable() wrapper to efivars	2016-05-04 14:48:49 -07:00
fmc
fpga
gpio	gpio: mpc8xxx: Correct irq handler function	2016-10-28 03:01:25 -04:00
gpu	drm/i915/dsi: Do not clear DPOUNIT_CLOCK_GATE_DISABLE from vlv_init_display_clock_gating	2017-03-15 09:57:15 +08:00
hid	HID: wacom: Fix poor prox handling in 'wacom_pl_irq'	2017-02-09 08:02:46 +01:00
hsi
hv	drivers: hv: Turn off write permission on the hypercall page	2017-03-15 09:57:15 +08:00
hwmon	hwmon: (g762) Fix overflows and crash seen when writing limit attributes	2017-01-12 11:22:48 +01:00
hwspinlock	drivers/hwspinlock: fix race between radix tree insertion and lookup	2016-02-25 12:01:23 -08:00
hwtracing	intel_th: Fix a deadlock in modprobing	2016-08-10 11:49:30 +02:00
i2c	i2c: fix kernel memory disclosure in dev interface	2017-01-19 20:17:20 +01:00
ide
idle	intel_idle: Support for Intel Xeon Phi Processor x200 Product Family	2016-09-15 08:27:46 +02:00
iio	iio: pressure: mpl3115: do not rely on structure field ordering	2017-03-12 06:37:28 +01:00
infiniband	IB/srp: Fix race conditions related to task management	2017-03-15 09:57:13 +08:00
input	Input: elan_i2c - add ELAN0605 to the ACPI table	2017-02-23 17:43:09 +01:00
iommu	iommu/vt-d: Tylersburg isoch identity map check is done too late.	2017-03-12 06:37:25 +01:00
ipack
irqchip	irqchip/bcm7038-l1: Implement irq_cpu_offline() callback	2017-01-12 11:22:49 +01:00
isdn	ISDN: eicon: silence misleading array-bounds warning	2017-02-01 08:30:52 +01:00
leds
lguest
lightnvm	lightnvm: put bio before return	2016-09-24 10:07:35 +02:00
macintosh
mailbox
mcb	mcb: Fixed bar number assignment for the gdd	2016-06-01 12:15:53 -07:00
md	dm: flush queued bios when process blocks to avoid deadlock	2017-03-18 19:09:58 +08:00
media	media: fix dm1105.c build error	2017-03-12 06:37:24 +01:00
memory	memory: omap-gpmc: Fix omap gpmc EXTRADELAY timing	2016-07-27 09:47:35 -07:00
memstick	memstick: rtsx_usb_ms: Manage runtime PM when accessing the device	2016-10-28 03:01:35 -04:00
message
mfd	mfd: core: Fix device reference leak in mfd_clone_cell	2016-11-26 09:54:53 +01:00
misc	mei: bus: fix mei_cldev_enable KDoc	2017-01-12 11:22:47 +01:00
mmc	mmc: core: fix multi-bit bus width without high-speed mode	2017-02-23 17:43:10 +01:00
mtd	mtd: pmcmsp: use kstrndup instead of kmalloc+strncpy	2017-03-18 19:09:56 +08:00
net	vrf: Fix use-after-free in vrf_xmit	2017-03-22 12:04:16 +01:00
nfc	mei: bus: fix received data size check in NFC fixup	2016-11-18 10:48:36 +01:00
ntb	ntb_transport: Pick an unused queue	2017-02-23 17:43:10 +01:00
nubus
nvdimm	nfit, libnvdimm: fix interleave set cookie calculation	2017-03-18 19:09:58 +08:00
nvme	nvme: Call pci_disable_device on the error path.	2016-09-15 08:27:51 +02:00
nvmem	nvmem: mxs-ocotp: fix buffer overflow in read	2016-05-11 11:21:21 +02:00
of	of: silence warnings due to max() usage	2016-11-15 07:46:39 +01:00
oprofile
parisc	parisc iommu: fix panic due to trying to allocate too large region	2015-12-12 16:07:25 +01:00
parport
pci	PCI/ASPM: Handle PCI-to-PCIe bridges as roots of PCIe hierarchies	2017-02-09 08:02:44 +01:00
pcmcia	pcmcia: db1xxx_ss: fix last irq_to_gpio user	2016-04-20 15:42:09 +09:00
perf	drivers/perf: arm_pmu: Fix leak in error path	2016-10-07 15:23:41 +02:00
phy	phy: core: fix wrong err handle for phy_power_on	2016-03-03 15:07:28 -08:00
pinctrl	pinctrl: broxton: Use correct PADCFGLOCK offset	2017-02-01 08:30:54 +01:00
platform	goldfish: Sanitize the broken interrupt handler	2017-02-26 11:07:51 +01:00
pnp	PNP: Add Broadwell to Intel MCH size workaround	2016-08-16 09:30:48 +02:00
power	power: bq24257: Fix use of uninitialized pointer bq->charger	2016-10-31 04:14:00 -06:00
powercap	powercap / RAPL: fix BIOS lock check	2015-12-12 02:31:11 +01:00
pps	pps: do not crash when failed to register	2016-08-10 11:49:25 +02:00
ps3
ptp
pwm	pwm: pca9685: Fix period change with same duty cycle	2017-03-15 09:57:14 +08:00
rapidio
ras
regulator	regulator: Fix regulator_summary for deviceless consumers	2017-03-12 06:37:25 +01:00
remoteproc	remoteproc: Fix potential race condition in rproc_add	2016-08-20 18:09:20 +02:00
reset
rpmsg
rtc	rtc: sun6i: Switch to the external oscillator	2017-03-12 06:37:30 +01:00
s390	s390/dcssblk: fix device size calculation in dcssblk_direct_access()	2017-03-15 09:57:12 +08:00
sbus
scsi	mvsas: fix misleading indentation	2017-03-18 19:09:58 +08:00
sfi
sh	drivers: sh: Restore legacy clock domain on SuperH platforms	2016-03-09 15:34:49 -08:00
sn
soc	soc: qcom/spm: shut up uninitialized variable warning	2016-09-24 10:07:42 +02:00
spi	spi: mvebu: fix baudrate calculation for armada variant	2017-01-15 13:41:36 +01:00
spmi
ssb	ssb: Fix error routine when fallback SPROM fails	2017-01-09 08:07:42 +01:00
staging	staging: rtl: fix possible NULL pointer dereference	2017-03-12 06:37:25 +01:00
target	target: Fix NULL dereference during LUN lookup + active I/O shutdown	2017-03-15 09:57:14 +08:00
tc
thermal	thermal: hwmon: Properly report critical temperature in sysfs	2017-01-09 08:07:44 +01:00
thunderbolt	thunderbolt: Fix double free of drom buffer	2016-06-01 12:15:53 -07:00
tty	serial: samsung: Continue to work if DMA request fails	2017-03-18 19:09:58 +08:00
uio	uio: fix dmem_region_start computation	2016-10-31 04:13:59 -06:00
usb	USB: serial: io_ti: fix information leak in completion handler	2017-03-18 19:09:58 +08:00
uwb	uwb: fix device reference leaks	2016-11-26 09:54:53 +01:00
vfio	vfio/pci: Fix NULL pointer oops in error interrupt setup handling	2016-09-07 08:32:37 +02:00
vhost	vhost/scsi: fix reuse of &vq->iov[out] in response	2016-09-15 08:27:53 +02:00
video	fbdev: color map copying bounds checking	2017-02-01 08:30:52 +01:00
virt
virtio	virtio_ring: Make interrupt suppression spec compliant	2016-11-10 16:36:34 +01:00
vlynq
vme	vme: Fix wrong pointer utilization in ca91cx42_slave_get	2017-01-19 20:17:21 +01:00
w1	w1: ds2490: USB transfer buffers need to be DMAable	2017-03-12 06:37:29 +01:00
watchdog	watchdog: rc32434_wdt: fix ioctl error handling	2016-04-12 09:08:54 -07:00
xen	xen/gntdev: Use VM_MIXEDMAP instead of VM_IO to avoid NUMA balancing	2017-01-06 11:16:17 +01:00
zorro
Kconfig
Makefile