David Ahern 89cd658056 vrf: Fix use after free and double free in vrf_finish_output ...

commit 82dd0d2a9a upstream.

Miguel reported an skb use after free / double free in vrf_finish_output
when neigh_output returns an error. The vrf driver should return after
the call to neigh_output as it takes over the skb on error path as well.

Patch is a simplified version of Miguel's patch which was written for 4.9,
and updated to top of tree.

Fixes: 8f58336d3f ("net: Add ethernet header for pass through VRF device")
Signed-off-by: Miguel Fadon Perlines <mfadon@teldat.com>
Signed-off-by: David Ahern <dsahern@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
[ backport to 4.4 and 4.9 dropped the sock_confirm_neigh and
  changed neigh_output to dst_neigh_output ]
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2018-04-13 19:48:37 +02:00

..

appletalk

net/appletalk: Fix kernel memory disclosure

2017-12-09 22:01:51 +01:00

arcnet

arcnet: com90xx: add __init attribute

2016-04-19 20:17:45 -04:00

bonding

bonding: process the err returned by dev_set_allmulti properly in bond_enslave

2018-04-13 19:48:34 +02:00

caif

Merge tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost

2016-08-06 09:20:13 -04:00

can

can: cc770: Fix use after free in cc770_tx_interrupt()

2018-03-28 18:39:24 +02:00

cris

treewide: replace dev->trans_start update with helper

2016-05-04 14:16:49 -04:00

dsa

net: dsa: b53: Include IMP/CPU port in dumb forwarding mode

2017-10-08 10:26:08 +02:00

ethernet

net/mlx4_core: Fix memory leak while delete slave's resources

2018-04-13 19:48:36 +02:00

fddi

net: skfb: remove obsolete -I cflag

2016-06-15 22:06:06 -07:00

fjes

fjes: Fix wrong netdevice feature flags

2017-12-20 10:07:22 +01:00

hamradio

hdlcdrv: Fix divide by zero in hdlcdrv_ioctl

2018-04-13 19:48:12 +02:00

hippi

hippi: Fix a Fix a possible sleep-in-atomic bug in rr_close

2018-02-25 11:05:50 +01:00

hyperv

netvsc: Deal with rescinded channels correctly

2018-03-24 11:00:13 +01:00

ieee802154

net: ieee802154: adf7242: Fix bug if defined DEBUG

2018-03-22 09:17:54 +01:00

ipvlan

ipvlan: add L2 check for packets arriving via virtual devices

2018-03-22 09:17:58 +01:00

irda

irda: vlsi_ir: fix check for DMA mapping errors

2017-12-25 14:23:41 +01:00

phy

net: phy: avoid genphy_aneg_done() for PHYs without clause 22 support

2018-04-13 19:48:22 +02:00

plip

net: plip: use new parport device model

2016-01-09 21:02:05 -05:00

ppp

pptp: remove a buggy dst release in pptp_connect()

2018-04-13 19:48:33 +02:00

slip

treewide: replace dev->trans_start update with helper

2016-05-04 14:16:49 -04:00

team

team: move dev_mc_sync after master_upper_dev_link in team_port_add

2018-04-13 19:48:36 +02:00

usb

net: cdc_ncm: Fix TX zero padding

2018-04-13 19:47:52 +02:00

vmxnet3

vmxnet3: ensure that adapter is in proper state during force_close

2018-04-13 19:47:55 +02:00

wan

net/wan/fsl_ucc_hdlc: fix muram allocation error

2018-04-13 19:48:03 +02:00

wimax

net: wimax/i2400m: fix NULL-deref at probe

2017-12-20 10:07:20 +01:00

wireless

iwlwifi: fix min API version for 7265D, 3168, 8000 and 8265

2018-04-13 19:48:21 +02:00

xen-netback

xen-netback: vif counters from int/long to u64

2017-12-09 22:01:55 +01:00

dummy.c

net: dummy: add more features

2015-10-21 19:36:10 -07:00

eql.c

…

geneve.c

geneve: add missing rx stats accounting

2018-04-13 19:48:26 +02:00

gtp.c

gtp: fix cross netns recv on gtp socket

2017-12-09 22:01:54 +01:00

ifb.c

ifb: support more features

2016-05-09 00:00:28 -04:00

Kconfig

vmxnet3: prevent building with 64K pages

2018-02-25 11:05:51 +01:00

LICENSE.SRC

…

loopback.c

net: introduce device min_header_len

2017-02-18 15:11:43 +01:00

macsec.c

macsec: check return value of skb_to_sgvec always

2018-04-13 19:48:19 +02:00

macvlan.c

macvlan: Fix one possible double free

2018-03-03 10:23:26 +01:00

macvtap.c

tap: double-free in error path in tap_open()

2017-11-18 11:22:22 +01:00

Makefile

gtp: add initial driver for datapath of GPRS Tunneling Protocol (GTP-U)

2016-05-10 12:25:04 -04:00

mdio.c

…

mii.c

…

netconsole.c

netconsole: use per-attribute show and store methods

2015-10-13 22:17:51 -07:00

nlmon.c

…

ntb_netdev.c

…

rionet.c

drivers: net: remove NETDEV_TX_LOCKED

2016-04-26 15:53:05 -04:00

sb1000.c

…

Space.c

net: Fix coding style warnings and errors.

2016-05-19 11:48:27 -07:00

sungem_phy.c

…

tun.c

tun: fix a memory leak for tfile->tx_array

2018-01-31 12:55:56 +01:00

veth.c

veth: set peer GSO values

2018-03-22 09:17:57 +01:00

virtio_net.c

virtio_net: check return value of skb_to_sgvec in one more location

2018-04-13 19:48:32 +02:00

vrf.c

vrf: Fix use after free and double free in vrf_finish_output

2018-04-13 19:48:37 +02:00

vxlan.c

vxlan: dont migrate permanent fdb entries during learn

2018-04-13 19:48:29 +02:00

xen-netfront.c

xen-netfront: enable device after manual module load

2018-03-03 10:23:27 +01:00