Johannes Berg b8fff407a1 mac80211: fix use-after-free in defragmentation ... Upon receiving the last fragment, all but the first fragment are freed, but the multicast check for statistics at the end of the function refers to the current skb (the last fragment) causing a use-after-free bug. Since multicast frames cannot be fragmented and we check for this early in the function, just modify that check to also do the accounting to fix the issue. Cc: stable@vger.kernel.org Reported-by: Yosef Khyal <yosefx.khyal@intel.com> Signed-off-by: Johannes Berg <johannes.berg@intel.com>		2014-11-03 14:28:50 +01:00
..
6lowpan
9p
802
8021q	net: better IFF_XMIT_DST_RELEASE support	2014-10-07 13:22:11 -04:00
appletalk
atm	net: better IFF_XMIT_DST_RELEASE support	2014-10-07 13:22:11 -04:00
ax25
batman-adv
bluetooth	Bluetooth: 6lowpan: Check transmit errors for multicast packets	2014-10-02 13:41:57 +03:00
bridge	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2014-10-08 16:22:22 -04:00
caif
can
ceph
core	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next	2014-10-08 21:40:54 -04:00
dcb
dccp	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next	2014-10-08 21:40:54 -04:00
decnet
dns_resolver
dsa	net: dsa: do not call phy_start_aneg	2014-10-04 20:44:44 -04:00
ethernet
hsr
ieee802154	Merge tag 'master-2014-10-02' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-next	2014-10-05 21:34:39 -04:00
ipv4	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next	2014-10-08 21:40:54 -04:00
ipv6	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next	2014-10-08 21:40:54 -04:00
ipx
irda	irda: add __init to irlan_open	2014-09-30 17:08:06 -04:00
iucv
key
l2tp
lapb
llc	net_dma: simple removal	2014-09-28 07:05:16 -07:00
mac80211	mac80211: fix use-after-free in defragmentation	2014-11-03 14:28:50 +01:00
mac802154	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next	2014-10-08 21:40:54 -04:00
mpls	net: Remove gso_send_check as an offload callback	2014-09-26 00:22:47 -04:00
netfilter	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next	2014-10-08 21:40:54 -04:00
netlabel	netlabel: directly return netlbl_unlabel_genl_init()	2014-10-08 16:08:04 -04:00
netlink
netrom
nfc	NFC: nci: Add support for proprietary RF Protocols	2014-09-24 02:02:24 +02:00
openvswitch	openvswitch: fix a sparse warning	2014-10-07 00:10:48 -04:00
packet
phonet	net: fix rcu access on phonet_routes	2014-10-06 18:16:30 -04:00
rds	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next	2014-10-08 21:40:54 -04:00
rfkill	net: rfkill: kernel-doc warning fixes	2014-10-09 11:16:15 +02:00
rose
rxrpc	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2014-09-23 12:09:27 -04:00
sched	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2014-10-08 16:22:22 -04:00
sctp	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2014-10-08 16:22:22 -04:00
sunrpc	Merge branch 'for-3.18' of git://linux-nfs.org/~bfields/linux	2014-10-08 12:51:44 -04:00
tipc	tipc: fix bug in multicast congestion handling	2014-10-07 14:50:15 -04:00
unix	af_unix: remove 0 assignment on static	2014-10-07 17:03:14 -04:00
vmw_vsock
wimax	wimax: convert printk to pr_foo()	2014-10-07 20:28:44 -04:00
wireless	nl80211: sanity check the channel switch counter value	2014-10-09 11:25:11 +02:00
x25
xfrm	net: cleanup and document skb fclone layout	2014-10-01 16:34:25 -04:00
compat.c
Kconfig	netfilter: bridge: build br_nf_core only if required	2014-09-30 14:07:51 -04:00
Makefile
nonet.c
socket.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2014-09-23 12:09:27 -04:00
sysctl_net.c