kevin/linux
1
Fork 0
Code
7799652557
linux/net
History
Evgeniy Polyakov 7799652557 [NETFILTER]: Fix NULL pointer dereference in nf_nat_move_storage() 
Reported by Chuck Ebbert as:

	https://bugzilla.redhat.com/show_bug.cgi?id=259501#c14

This routine is called each time hash should be replaced, nf_conn has
extension list which contains pointers to connection tracking users
(like nat, which is right now the only such user), so when replace takes
place it should copy own extensions. Loop above checks for own
extension, but tries to move higer-layer one, which can lead to above
oops.

Signed-off-by: Evgeniy Polyakov <johnpol@2ka.mipt.ru>
Signed-off-by: David S. Miller <davem@davemloft.net>
2007-11-15 15:52:32 -08:00
..
9p 9p: add missing end-of-options record for trans_fd 2007-11-06 08:02:53 -06:00
802 [NET]: Move hardware header operations out of netdevice. 2007-10-10 16:52:52 -07:00
8021q [VLAN]: Allow setting mac address while device is up 2007-11-10 21:52:35 -08:00
appletalk [NET]: Forget the zero_it argument of sk_alloc() 2007-11-01 00:39:31 -07:00
atm [NET]: Forget the zero_it argument of sk_alloc() 2007-11-01 00:39:31 -07:00
ax25 [NET]: Forget the zero_it argument of sk_alloc() 2007-11-01 00:39:31 -07:00
bluetooth [NET]: Forget the zero_it argument of sk_alloc() 2007-11-01 00:39:31 -07:00
bridge [NETFILTER]: bridge: fix double POSTROUTING hook invocation 2007-11-13 02:58:44 -08:00
core [INET]: Fix potential kfree on vmalloc-ed area of request_sock_queue 2007-11-15 02:57:06 -08:00
dccp [INET]: Remove per bucket rwlock in tcp/dccp ehash table. 2007-11-07 04:15:11 -08:00
decnet [INET]: Small possible memory leak in FIB rules 2007-11-10 22:12:03 -08:00
econet [NET]: Forget the zero_it argument of sk_alloc() 2007-11-01 00:39:31 -07:00
ethernet [NET]: Validate device addr prior to interface-up 2007-10-23 21:27:50 -07:00
ieee80211 softmac: fix wext MLME request reason code endianness 2007-11-10 21:58:41 -08:00
ipv4 [NET]: rt_check_expire() can take a long time, add a cond_resched() 2007-11-14 16:14:05 -08:00
ipv6 [IPV6]: Add ifindex field to ND user option messages. 2007-11-12 17:58:35 -08:00
ipx [IPX]: Use existing sock refcnt debugging infrastructure 2007-11-10 21:39:26 -08:00
irda [IRDA] IRNET: Fix build when TCGETS2 is defined. 2007-11-01 02:26:38 -07:00
iucv [NET]: Forget the zero_it argument of sk_alloc() 2007-11-01 00:39:31 -07:00
key [NET]: Forget the zero_it argument of sk_alloc() 2007-11-01 00:39:31 -07:00
lapb
llc [NET]: Forget the zero_it argument of sk_alloc() 2007-11-01 00:39:31 -07:00
mac80211 Merge branch 'fixes-davem' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6 2007-11-14 19:44:02 -08:00
netfilter [NETFILTER]: Fix NULL pointer dereference in nf_nat_move_storage() 2007-11-15 15:52:32 -08:00
netlabel [NetLabel]: correct usage of RCU locking 2007-10-26 04:29:08 -07:00
netlink [NET]: Move unneeded data to initdata section. 2007-11-13 03:23:50 -08:00
netrom [NET]: Forget the zero_it argument of sk_alloc() 2007-11-01 00:39:31 -07:00
packet [AF_PACKET]: Fix minor code duplication 2007-11-12 21:05:20 -08:00
rfkill rfkill: Fix sparse warning 2007-11-10 22:00:28 -08:00
rose [NET]: Forget the zero_it argument of sk_alloc() 2007-11-01 00:39:31 -07:00
rxrpc [NET]: Add the helper kernel_sock_shutdown() 2007-11-12 18:10:39 -08:00
sched [PKT_SCHED]: Check subqueue status before calling hard_start_xmit 2007-11-13 20:40:55 -08:00
sctp Fix memory leak in discard case of sctp_sf_abort_violation() 2007-11-12 10:13:24 -05:00
sunrpc sunrpc/xprtrdma/transport.c: fix use-after-free 2007-11-14 18:45:41 -08:00
tipc [NET]: Forget the zero_it argument of sk_alloc() 2007-11-01 00:39:31 -07:00
unix [UNIX]: The unix_nr_socks limit can be exceeded 2007-11-10 22:08:30 -08:00
wanrouter [NET]: Make /proc/net per network namespace 2007-10-10 16:49:06 -07:00
wireless Driver core: change add_uevent_var to use a struct 2007-10-12 14:51:01 -07:00
x25 [NET]: Forget the zero_it argument of sk_alloc() 2007-11-01 00:39:31 -07:00
xfrm cleanup asm/scatterlist.h includes 2007-11-02 08:47:06 +01:00
compat.c
Kconfig [NET]: Add network namespace clone & unshare support. 2007-10-10 16:52:46 -07:00
Makefile
nonet.c
socket.c [NET]: Add the helper kernel_sock_shutdown() 2007-11-12 18:10:39 -08:00
sysctl_net.c
TUNABLE