Bjorn Andersson 48ec949ac9 net: qrtr: Avoid potential use after free in MHI send ... commit 47a017f33943278570c072bc71681809b2567b3a upstream. It is possible that the MHI ul_callback will be invoked immediately following the queueing of the skb for transmission, leading to the callback decrementing the refcount of the associated sk and freeing the skb. As such the dereference of skb and the increment of the sk refcount must happen before the skb is queued, to avoid the skb to be used after free and potentially the sk to drop its last refcount.. Fixes: 6e728f3213 ("net: qrtr: Add MHI transport layer") Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2021-05-07 11:04:31 +02:00
..
6lowpan
9p	net: 9p: advance iov on empty read	2021-04-07 15:00:08 +02:00
802
8021q
appletalk	appletalk: Fix skb allocation size in loopback case	2021-04-07 15:00:08 +02:00
atm
ax25
batman-adv	batman-adv: initialize "struct batadv_tvlv_tt_vlan_data"->reserved field	2021-04-14 08:41:59 +02:00
bluetooth
bpf
bpfilter
bridge	netfilter: bridge: add pre_exit hooks for ebtable unregistration	2021-04-21 13:00:55 +02:00
caif
can	can: isotp: fix msg_namelen values depending on CAN_REQUIRED_SIZE	2021-04-14 08:42:07 +02:00
ceph
core	gro: ensure frag0 meets IP header alignment	2021-04-21 13:00:58 +02:00
dcb
dccp	ipv6: weaken the v4mapped source check	2021-03-30 14:32:01 +02:00
decnet
dns_resolver
dsa	net: dsa: Fix type was not set for devlink port	2021-04-14 08:42:07 +02:00
ethernet
ethtool	ethtool: pause: make sure we init driver stats	2021-04-21 13:00:57 +02:00
hsr	net: hsr: Reset MAC header for Tx path	2021-04-14 08:42:02 +02:00
ieee802154	net: ieee802154: forbid monitor for add llsec seclevel	2021-04-21 13:00:53 +02:00
ife
ipv4	net: Make tcp_allowed_congestion_control readonly in non-init netns	2021-04-21 13:00:57 +02:00
ipv6	net: ip6_tunnel: Unregister catch-all devices	2021-04-21 13:00:57 +02:00
iucv
kcm
key
l2tp	net: l2tp: reduce log level of messages in receive path, add counter instead	2021-03-17 17:06:11 +01:00
l3mdev
lapb
llc
mac80211	mac80211: clear sta->fast_rx when STA removed from 4-addr VLAN	2021-04-21 13:00:54 +02:00
mac802154	net: mac802154: Fix general protection fault	2021-04-14 08:42:13 +02:00
mpls	net: avoid infinite loop in mpls_gso_segment when mpls_hlen == 0	2021-03-17 17:06:11 +01:00
mptcp	mptcp: forbit mcast-related sockopt on MPTCP sockets	2021-04-14 08:42:09 +02:00
ncsi	net/ncsi: Avoid channel_monitor hrtimer deadlock	2021-04-14 08:42:08 +02:00
netfilter	netfilter: conntrack: Make global sysctls readonly in non-init netns	2021-05-07 11:04:31 +02:00
netlabel	cipso,calipso: resolve a number of problems with the DOI refcounts	2021-03-17 17:06:15 +01:00
netlink
netrom
nfc	nfc: Avoid endless loops caused by repeated llcp_sock_connect()	2021-04-14 08:41:57 +02:00
nsh
openvswitch	openvswitch: fix send of uninitialized stack memory in ct limit reply	2021-04-14 08:42:10 +02:00
packet
phonet
psample
qrtr	net: qrtr: Avoid potential use after free in MHI send	2021-05-07 11:04:31 +02:00
rds	net/rds: Fix a use after free in rds_message_map_pages	2021-04-14 08:42:09 +02:00
rfkill
rose
rxrpc
sched	Revert "net: sched: bump refcount for new action in ACT replace mode"	2021-04-14 08:42:14 +02:00
sctp	net/sctp: fix race condition in sctp_destroy_sock	2021-04-21 13:00:50 +02:00
smc
strparser
sunrpc	rpc: fix NULL dereference on kmalloc failure	2021-04-07 15:00:04 +02:00
switchdev
tipc	tipc: increment the tmp aead refcnt before attaching it	2021-04-14 08:42:11 +02:00
tls
unix
vmw_vsock	selinux: vsock: Set SID for socket returned by accept()	2021-03-30 14:32:03 +02:00
wimax
wireless	cfg80211: remove WARN_ON() in cfg80211_sme_connect	2021-04-14 08:42:13 +02:00
x25
xdp
xfrm	xfrm: BEET mode doesn't support fragments for inner packets	2021-04-21 13:00:51 +02:00
compat.c
devres.c
Kconfig
Makefile
socket.c
sysctl_net.c