David Ahern e671f1cc58 vrf: Fix use-after-free in vrf_xmit ... [ Upstream commit f7887d40e5 ] KASAN detected a use-after-free: [ 269.467067] BUG: KASAN: use-after-free in vrf_xmit+0x7f1/0x827 [vrf] at addr ffff8800350a21c0 [ 269.467067] Read of size 4 by task ssh/1879 [ 269.467067] CPU: 1 PID: 1879 Comm: ssh Not tainted 4.10.0+ #249 [ 269.467067] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.7.5-20140531_083030-gandalf 04/01/2014 [ 269.467067] Call Trace: [ 269.467067] dump_stack+0x81/0xb6 [ 269.467067] kasan_object_err+0x21/0x78 [ 269.467067] kasan_report+0x2f7/0x450 [ 269.467067] ? vrf_xmit+0x7f1/0x827 [vrf] [ 269.467067] ? ip_output+0xa4/0xdb [ 269.467067] __asan_load4+0x6b/0x6d [ 269.467067] vrf_xmit+0x7f1/0x827 [vrf] ... Which corresponds to the skb access after xmit handling. Fix by saving skb->len and using the saved value to update stats. Fixes: 193125dbd8 ("net: Introduce VRF device driver") Signed-off-by: David Ahern <dsa@cumulusnetworks.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2017-03-22 12:04:16 +01:00
..
appletalk
arcnet	arcnet/com20020: add LEDS_CLASS dependency	2015-11-03 11:29:56 -05:00
bonding	bonding: Fix bonding crash	2016-09-30 10:18:36 +02:00
caif	net: caif: check return value of alloc_netdev	2015-11-09 11:31:13 -05:00
can	can: usb_8dev: Fix memory leak of priv->cmd_msg_buffer	2017-03-12 06:37:28 +01:00
cris
dsa	net: dsa: bcm_sf2: Ensure we re-negotiate EEE during after link change	2016-12-10 19:07:23 +01:00
ethernet	cpmac: remove hopeless #warning	2017-03-18 19:09:56 +08:00
fddi
fjes	fjes: fix inconsistent indenting	2015-11-15 17:09:23 -05:00
hamradio	mkiss: fix scribble on freed memory	2016-01-06 15:06:27 -05:00
hippi
hyperv	netvsc: Set maximum GSO size in the right place	2017-02-14 15:22:51 -08:00
ieee802154	fakelb: fix schedule while atomic	2017-03-15 09:57:15 +08:00
ipvlan	ipvlan: fix use after free of skb	2015-11-17 14:39:29 -05:00
irda	net: irda: Fix use-after-free in irtty_open()	2016-04-12 09:08:49 -07:00
phy	net: phy: bcm63xx: Utilize correct config_intr function	2017-02-04 09:45:09 +01:00
plip
ppp	ppp: defer netns reference release for ppp channel	2017-01-06 11:16:17 +01:00
slip	ppp, slip: Validate VJ compression slot parameters completely	2015-11-02 16:25:00 -05:00
team	team: don't call netdev_change_features under team->lock	2016-06-24 10:18:17 -07:00
usb	qmi_wwan/cdc_ether: add device ID for HP lt2523 (Novatel E371) WWAN card	2017-02-04 09:45:09 +01:00
vmxnet3	Driver: Vmxnet3: Fix regression caused by 5738a09	2016-01-06 16:20:13 -05:00
wan	farsync: fix off-by-one bug in fst_add_one	2016-04-20 15:42:03 +09:00
wimax
wireless	rtlwifi: rtl8192c-common: Fix "BUG: KASAN:	2017-03-12 06:37:30 +01:00
xen-netback	xen: bug fixes for 4.4-rc5	2015-12-18 12:24:52 -08:00
dummy.c	net: dummy: add more features	2015-10-21 19:36:10 -07:00
eql.c
geneve.c	geneve: avoid use-after-free of skb->data	2016-12-10 19:07:24 +01:00
ifb.c
Kconfig	net: Add IPv6 support to VRF device	2015-10-13 04:55:07 -07:00
LICENSE.SRC
loopback.c	net: introduce device min_header_len	2017-02-18 16:39:27 +01:00
macvlan.c	macvlan: fix leak in macvlan_handle_frame	2015-11-17 14:39:29 -05:00
macvtap.c	macvtap: read vnet_hdr_size once	2017-02-18 16:39:27 +01:00
Makefile
mdio.c
mii.c
netconsole.c	netconsole: use per-attribute show and store methods	2015-10-13 22:17:51 -07:00
nlmon.c
ntb_netdev.c	NTB: Add flow control to the ntb_netdev	2015-09-07 15:17:08 -04:00
rionet.c	rapidio/rionet: fix deadlock on SMP	2016-04-12 09:08:58 -07:00
sb1000.c
Space.c
sungem_phy.c
tun.c	tun: read vnet_hdr_sz once	2017-02-18 16:39:27 +01:00
veth.c	veth: don’t modify ip_summed; doing so treats packets with bad checksums as good.	2015-12-22 15:15:34 -05:00
virtio_net.c	virtio-net: add a missing synchronize_net()	2016-12-10 19:07:22 +01:00
vrf.c	vrf: Fix use-after-free in vrf_xmit	2017-03-22 12:04:16 +01:00
vxlan.c	vxlan: correctly validate VXLAN ID against VXLAN_N_VID	2017-03-22 12:04:13 +01:00
xen-netfront.c	xen-netfront: Delete rx_refill_timer in xennet_disconnect_backend()	2017-02-14 15:22:52 -08:00