linux/net
Herbert Xu 0da2afd596 gro: Fix potential use after free
The initial skb may have been freed after napi_gro_complete in
napi_gro_receive if it was merged into an existing packet.  Thus
we cannot check same_flow (which indicates whether it was merged)
after calling napi_gro_complete.

This patch fixes this by saving the same_flow status before the
call to napi_gro_complete.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
2008-12-26 14:57:42 -08:00
..
9p net: remove redundant argument comments 2008-11-21 17:15:03 -08:00
802 hippi: convert driver to net_device_ops 2008-11-20 20:32:15 -08:00
8021q vlan: fix convertion to net_device_ops 2008-12-25 16:45:19 -08:00
appletalk net/appletalk: Remove redundant test 2008-12-25 18:04:51 -08:00
atm netdevice: Kill netdev->priv 2008-12-08 01:14:16 -08:00
ax25 ax25: join the return paths that free skb 2008-12-14 23:17:26 -08:00
bluetooth Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6 2008-12-23 17:56:23 -08:00
bridge Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/kaber/nf-next-2.6 2008-11-28 02:19:15 -08:00
can can: merge error paths 2008-12-14 23:16:58 -08:00
core gro: Fix potential use after free 2008-12-26 14:57:42 -08:00
dcb net: add DCNA attribute to the BCN interface for DCB 2008-12-21 20:10:29 -08:00
dccp dccp_diag: LISTEN sockets don't have CCIDs 2008-12-17 16:08:01 -08:00
decnet net: Make static 2008-12-10 15:18:31 -08:00
dsa net: Make static 2008-12-10 15:18:31 -08:00
econet
ethernet eth: Declare an optimized compare_ether_addr_64bits() function 2008-11-23 23:24:32 -08:00
ipv4 ipsec: Remove useless ret variable 2008-12-26 01:31:18 -08:00
ipv6 ipv6: fix the outgoing interface selection order in udpv6_sendmsg() 2008-12-16 02:08:29 -08:00
ipx
irda irda: merge exit paths 2008-12-14 23:18:30 -08:00
iucv
key netns PF_KEY: per-netns /proc/pfkey 2008-11-25 17:59:00 -08:00
lapb
llc net: remove redundant argument comments 2008-11-21 17:15:03 -08:00
mac80211 mac80211: implement dynamic power save 2008-12-19 15:24:00 -05:00
netfilter Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6 2008-12-15 20:03:50 -08:00
netlabel Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6 2008-12-15 20:03:50 -08:00
netlink netlink: allow empty nested attributes 2008-11-28 03:05:19 -08:00
netrom
packet net: Make sure BHs are disabled in sock_prot_inuse_add() 2008-11-24 00:09:29 -08:00
phonet Phonet: get rid of deferred work on the transmission path 2008-12-17 15:48:50 -08:00
rfkill rfkill: strip pointless notifier chain 2008-12-12 14:45:25 -05:00
rose Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6 2008-11-26 23:48:40 -08:00
rxrpc net: Make static 2008-12-10 15:18:31 -08:00
sched pkt_sched: Remove smp_wmb() in qdisc_watchdog() 2008-12-22 19:44:13 -08:00
sctp sctp: Add validity check for SCTP_PARTIAL_DELIVERY_POINT socket option 2008-12-25 16:59:03 -08:00
sunrpc Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6 2008-12-15 20:03:50 -08:00
tipc
unix Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6 2008-12-02 19:50:27 -08:00
wanrouter netdevice wanrouter: Convert directly reference of netdev->priv 2008-11-20 04:26:21 -08:00
wireless mac80211: Fix HT channel selection 2008-12-19 15:22:54 -05:00
x25
xfrm Revert "xfrm: Accept ESP packets regardless of UDP encapsulation mode" 2008-12-18 22:27:37 -08:00
compat.c
Kconfig net/ieee80211 -> drivers/net/ipw2x00/libipw_* rename 2008-11-21 11:08:18 -05:00
Makefile DCB: fix kconfig option 2008-11-25 01:02:08 -08:00
nonet.c
socket.c Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6 2008-12-23 17:56:23 -08:00
sysctl_net.c
TUNABLE