Florian Westphal b078556aec netfilter: ipv6: fix use-after-free Write in nf_nat_ipv6_manip_pkt ... l4proto->manip_pkt() can cause reallocation of skb head so pointer to the ipv6 header must be reloaded. Reported-and-tested-by: <syzbot+10005f4292fc9cc89de7@syzkaller.appspotmail.com> Fixes: 58a317f106 ("netfilter: ipv6: add IPv6 NAT support") Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>		2018-02-25 20:03:54 +01:00
..
6lowpan
9p
802
8021q
appletalk
atm
ax25
batman-adv
bluetooth
bpf
bridge	Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf	2018-02-21 14:49:55 -05:00
caif
can
ceph
core	net_sched: gen_estimator: fix broken estimators based on percpu stats	2018-02-23 12:35:46 -05:00
dcb
dccp
decnet	dn_getsockoptdecnet: move nf_{get/set}sockopt outside sock lock	2018-02-16 15:46:15 -05:00
dns_resolver
dsa
ethernet
hsr
ieee802154
ife
ipv4	netfilter: ipt_CLUSTERIP: put config instead of freeing it	2018-02-25 20:02:51 +01:00
ipv6	netfilter: ipv6: fix use-after-free Write in nf_nat_ipv6_manip_pkt	2018-02-25 20:03:54 +01:00
iucv
kcm
key
l2tp
l3mdev
lapb
llc
mac80211	Various fixes across the tree, the shortlog basically says it all:	2018-02-22 15:17:01 -05:00
mac802154
mpls
ncsi
netfilter	netfilter: IDLETIMER: be syzkaller friendly	2018-02-19 18:28:59 +01:00
netlabel
netlink	netlink: put module reference if dump start fails	2018-02-22 14:01:38 -05:00
netrom
nfc	NFC: llcp: Limit size of SDP URI	2018-02-16 15:16:05 -05:00
nsh
openvswitch
packet
phonet
psample
qrtr
rds
rfkill
rose
rxrpc	rxrpc: Fix send in rxrpc_send_data_packet()	2018-02-22 15:37:47 -05:00
sched	net: sched: report if filter is too large to dump	2018-02-20 21:57:17 -05:00
sctp	sctp: remove the left unnecessary check for chunk in sctp_renege_events	2018-02-16 16:32:37 -05:00
smc
strparser
sunrpc
switchdev
tipc
tls
unix
vmw_vsock
wimax
wireless	Various fixes across the tree, the shortlog basically says it all:	2018-02-22 15:17:01 -05:00
x25
xfrm
compat.c
Kconfig
Makefile
socket.c
sysctl_net.c