David S. Miller 7599b39d52 x25: Do not reference freed memory. ...

commit 96642d42f0 upstream.

In x25_link_free(), we destroy 'nb' before dereferencing
'nb->dev'.  Don't do this, because 'nb' might be freed
by then.

Reported-by: Randy Dunlap <randy.dunlap@oracle.com>
Tested-by: Randy Dunlap <randy.dunlap@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

2011-03-02 09:47:07 -05:00

..

af_x25.c

x25: Patch to fix bug 15678 - x25 accesses fields beyond end of packet.

2010-12-09 13:27:09 -08:00

Kconfig

[NET]: move config options out to individual protocols

2005-07-11 21:13:56 -07:00

Makefile

[X.25]: Add call forwarding

2007-02-08 13:34:02 -08:00

sysctl_net_x25.c

net: '&' redux

2008-11-03 18:21:05 -08:00

x25_dev.c

netns: Use net_eq() to compare net-namespaces for optimization.

2008-07-19 22:34:43 -07:00

x25_facilities.c

x25: Prevent crashing when parsing bad X.25 facilities

2010-12-09 13:27:10 -08:00

x25_forward.c

[X25]: use LIST_HEAD instead of LIST_HEAD_INIT

2008-01-28 14:56:53 -08:00

x25_in.c

memory corruption in X.25 facilities parsing

2010-12-09 13:27:09 -08:00

x25_link.c

x25: Do not reference freed memory.

2011-03-02 09:47:07 -05:00

x25_out.c

[SK_BUFF]: Introduce skb_copy_to_linear_data{_offset}

2007-04-25 22:28:29 -07:00

x25_proc.c

net: correct off-by-one write allocations reports

2009-06-18 00:29:12 -07:00

x25_route.c

[X25]: use LIST_HEAD instead of LIST_HEAD_INIT

2008-01-28 14:56:53 -08:00

x25_subr.c

[X25]: Avoid divides and sparse warnings

2008-01-28 15:02:03 -08:00

x25_timer.c

x25: Fix sleep from timer on socket destroy.

2009-06-16 05:40:30 -07:00