iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
linux/net
History
Jon Paul Maloy 3d09fc4244 tipc: eliminate case of writing to freed memory 
In the function tipc_nodesub_notify() we call a function pointer
aggregated into the object to be notified, whereafter we set
the function pointer to NULL. However, in some cases the function
pointed to will free the struct containing the function pointer,
resulting in a write to already freed memory.

This bug seems to always have been there, without causing any
notable harm.

In this commit we fix the problem by inverting the order of the
zeroing and the function call.

Signed-off-by: Jon Maloy <jon.maloy@ericsson.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2014-06-27 12:50:54 -07:00
..
9p
A bunch of updates and cleanup within the transport layer,
2014-04-11 14:14:57 -07:00
802
neigh: use NEIGH_VAR_INIT in ndo_neigh_setup functions.
2014-01-16 11:31:58 -08:00
8021q
8021q: fix a potential memory leak
2014-06-21 15:12:13 -07:00
appletalk
net: Split sk_no_check into sk_no_check_{rx,tx}
2014-05-23 16:28:53 -04:00
atm
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next
2014-06-12 14:27:40 -07:00
ax25
net: Fix use after free by removing length arg from sk_data_ready callbacks.
2014-04-11 16:15:36 -04:00
batman-adv
net: add __pskb_copy_fclone and pskb_copy_for_clone
2014-06-11 15:38:02 -07:00
bluetooth
Bluetooth: Allow change security level on ATT_CID in slave role
2014-06-13 14:36:39 +02:00
bridge
bridge: use list_for_each_entry_continue_reverse
2014-06-21 15:33:22 -07:00
caif
net: Fix use after free by removing length arg from sk_data_ready callbacks.
2014-04-11 16:15:36 -04:00
can
can: add hash based access to single EFF frame filters
2014-05-19 09:38:24 +02:00
ceph
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph-client
2014-06-12 23:06:23 -07:00
core
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
2014-06-25 22:40:43 -07:00
dcb
net: Use netlink_ns_capable to verify the permisions of netlink messages
2014-04-24 13:44:54 -04:00
dccp
net: Eliminate no_check from protosw
2014-05-23 16:28:53 -04:00
decnet
net: Split sk_no_check into sk_no_check_{rx,tx}
2014-05-23 16:28:53 -04:00
dns_resolver
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
2014-06-11 16:02:55 -07:00
dsa
net/dsa/dsa.c: remove unnecessary null test before kfree
2014-06-25 16:15:16 -07:00
ethernet
net: eth_type_trans() should use skb_header_pointer()
2014-01-16 15:30:31 -08:00
hsr
hsr: replace del_timer by del_timer_sync
2014-03-27 15:28:06 -04:00
ieee802154
6lowpan_rtnl: fix off by one while fragmentation
2014-06-02 10:39:42 -07:00
ipv4
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
2014-06-25 22:40:43 -07:00
ipv6
tcp: move ir_mark initialization to tcp_openreq_init
2014-06-17 15:30:54 -07:00
ipx
net: Split sk_no_check into sk_no_check_{rx,tx}
2014-05-23 16:28:53 -04:00
irda
trivial: net/irda/irlmp.c: Fix closing brace followed by if
2014-06-23 15:04:33 -07:00
iucv
af_iucv: correct cleanup if listen backlog is full
2014-05-30 17:35:23 -07:00
key
af_key: Replace comma with semicolon
2014-05-30 17:48:58 -07:00
l2tp
l2tp: call udp{6}_set_csum
2014-06-04 22:46:38 -07:00
lapb
…
llc
llc: remove noisy WARN from llc_mac_hdr_init
2014-01-28 18:01:32 -08:00
mac80211
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
2014-06-11 16:02:55 -07:00
mac802154
mac802154: don't deliver packets to devices that are down
2014-06-11 12:10:19 -07:00
mpls
gre: Call gso_make_checksum
2014-06-04 22:46:38 -07:00
netfilter
netfilter: nf_nat: fix oops on netns removal
2014-06-16 13:58:54 +02:00
netlabel
…
netlink
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
2014-06-03 23:32:12 -07:00
netrom
net: Fix use after free by removing length arg from sk_data_ready callbacks.
2014-04-11 16:15:36 -04:00
nfc
net: add __pskb_copy_fclone and pskb_copy_for_clone
2014-06-11 15:38:02 -07:00
openvswitch
vxlan: Add support for UDP checksums (v4 sending, v6 zero csums)
2014-06-04 22:46:39 -07:00
packet
net: Use netlink_ns_capable to verify the permisions of netlink messages
2014-04-24 13:44:54 -04:00
phonet
net: Use netlink_ns_capable to verify the permisions of netlink messages
2014-04-24 13:44:54 -04:00
rds
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next
2014-06-12 14:27:40 -07:00
rfkill
Merge git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211-next
2014-05-22 13:58:36 -04:00
rose
net: Fix use after free by removing length arg from sk_data_ready callbacks.
2014-04-11 16:15:36 -04:00
rxrpc
af_rxrpc: Fix XDR length check in rxrpc key demarshalling.
2014-05-16 15:24:47 -04:00
sched
net: em_canid: remove useless statements from em_canid_change
2014-06-21 15:40:22 -07:00
sctp
net: sctp: check proc_dointvec result in proc_sctp_do_auth
2014-06-19 21:30:19 -07:00
sunrpc
NFSv4: test SECINFO RPC_AUTH_GSS pseudoflavors for support
2014-06-24 18:46:58 -04:00
tipc
tipc: eliminate case of writing to freed memory
2014-06-27 12:50:54 -07:00
unix
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next
2014-06-12 14:27:40 -07:00
vmw_vsock
vsock: Make transport the proto owner
2014-05-05 13:13:50 -04:00
wimax
…
wireless
Merge git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211-next
2014-05-29 12:55:38 -04:00
x25
net: Fix use after free by removing length arg from sk_data_ready callbacks.
2014-04-11 16:15:36 -04:00
xfrm
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
2014-06-03 23:32:12 -07:00
compat.c
net/compat: convert to COMPAT_SYSCALL_DEFINE with changing parameter types
2014-03-06 16:30:45 +01:00
Kconfig
Merge branch 'for-3.15' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup
2014-04-03 13:05:42 -07:00
Makefile
net: move 6lowpan compression code to separate module
2014-01-15 15:36:38 -08:00
nonet.c
…
socket.c
net: use SYSCALL_DEFINEx for sys_recv
2014-04-16 15:15:05 -04:00
sysctl_net.c
…