WANG Cong d744318574 net_sched: fix a use-after-free in tc_ctl_tfilter() ...

When tcf_destroy() returns true, tp could be already destroyed,
we should not use tp->next after that.

For long term, we probably should move tp list to list_head.

Fixes: 1e052be69d04 ("net_sched: destroy proto tp when all filters are gone")
Cc: Jamal Hadi Salim <jhs@mojatatu.com>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

2015-05-09 16:14:04 -04:00

..

6lowpan

6lowpan: nhc: add other known rfc6282 compressions

2015-02-14 23:08:44 +01:00

9p

9p: patches for 4.1 merge window

2015-04-18 17:45:30 -04:00

802

net: Kill dev_rebuild_header

2015-03-02 16:43:41 -05:00

8021q

vlan: implement ndo_get_iflink

2015-04-02 14:05:00 -04:00

appletalk

appletalk: Use eth_<foo>_addr instead of memset

2015-03-03 17:01:37 -05:00

atm

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next

2015-04-15 09:00:47 -07:00

ax25

ax25: Fix the build when CONFIG_INET is disabled

2015-03-05 13:17:39 -05:00

batman-adv

dev: introduce dev_get_iflink()

2015-04-02 14:04:59 -04:00

bluetooth

Bluetooth: Skip the shutdown routine if the interface is not up

2015-04-30 18:45:27 +02:00

bridge

bridge/nl: remove wrong use of NLM_F_MULTI

2015-04-29 14:59:16 -04:00

caif

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

2015-03-20 18:51:09 -04:00

can

can: introduce new raw socket option to join the given CAN filters

2015-04-01 11:28:22 +02:00

ceph

crush: straw2 bucket type with an efficient 64-bit crush_ln()

2015-04-22 18:33:43 +03:00

core

net: core: Correct an over-stringent device loop detection.

2015-05-04 14:57:59 -04:00

dcb

net/dcb: Add IEEE QCN attribute

2015-03-06 21:50:02 -05:00

dccp

inet: fix possible panic in reqsk_queue_unlink()

2015-04-24 11:39:15 -04:00

decnet

netfilter: Pass socket pointer down through okfn().

2015-04-07 15:25:55 -04:00

dns_resolver

Merge commit 'v3.16' into next

2014-10-01 00:44:04 +10:00

dsa

net: dsa: Fix scope of eeprom-length property

2015-04-29 15:35:04 -04:00

ethernet

ethernet: Use eth_<foo>_addr instead of memset

2015-03-03 17:01:38 -05:00

hsr

net/hsr: Fix NULL pointer dereference and refcnt bugs when deleting a HSR interface.

2015-03-01 13:40:23 -05:00

ieee802154

ieee802154: trace: fix endian convertion

2015-04-30 18:48:11 +02:00

ipv4

tcp_westwood: fix tcp_westwood_info()

2015-05-05 19:50:09 -04:00

ipv6

ipv6: Fixed source specific default route handling.

2015-05-09 15:58:41 -04:00

ipx

net: Remove iocb argument from sendmsg and recvmsg

2015-03-02 13:06:31 -05:00

irda

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

2015-03-09 23:38:02 -04:00

iucv

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

2015-04-02 16:16:53 -04:00

key

xfrm: simplify xfrm_address_t use

2015-03-31 13:58:35 -04:00

l2tp

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

2015-04-06 22:34:15 -04:00

lapb

lapb: move EXPORT_SYMBOL after functions.

2014-10-24 15:51:42 -04:00

llc

net: Remove iocb argument from sendmsg and recvmsg

2015-03-02 13:06:31 -05:00

mac80211

mac80211: enable hash table shrinking

2015-04-24 11:11:57 +02:00

mac802154

Merge branch 'for-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth

2015-05-09 15:51:00 -04:00

mpls

mpls: Move reserved label definitions

2015-05-05 19:40:36 -04:00

netfilter

Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf

2015-04-27 23:12:34 -04:00

netlabel

netlink: implement nla_put_in_addr and nla_put_in6_addr

2015-03-31 13:58:35 -04:00

netlink

netlink: Remove max_size setting

2015-05-03 23:27:02 -04:00

netrom

net: Kill dev_rebuild_header

2015-03-02 16:43:41 -05:00

nfc

nfc: Fix portid type in urelease_work

2015-04-13 16:35:16 -04:00

openvswitch

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next

2015-04-15 09:00:47 -07:00

packet

af_packet: pass checksum validation status to the user

2015-03-23 22:01:28 -04:00

phonet

net: Remove iocb argument from sendmsg and recvmsg

2015-03-02 13:06:31 -05:00

rds

net/rds: RDS-TCP: only initiate reconnect attempt on outgoing TCP socket.

2015-05-09 16:03:28 -04:00

rfkill

Last round of updates for net-next:

2015-02-04 14:57:45 -08:00

rose

net: Kill dev_rebuild_header

2015-03-02 16:43:41 -05:00

rxrpc

new helper: msg_data_left()

2015-04-11 15:53:35 -04:00

sched

net_sched: fix a use-after-free in tc_ctl_tfilter()

2015-05-09 16:14:04 -04:00

sctp

sctp: avoid to repeatedly declare external variables

2015-03-25 11:40:16 -04:00

sunrpc

NFS client updates for Linux 4.1

2015-04-26 17:33:59 -07:00

switchdev

switchdev: fix stp update API to work with layered netdevices

2015-03-23 16:44:56 -04:00

tipc

tipc: fix problem with parallel link synchronization mechanism

2015-04-29 15:08:59 -04:00

unix

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

2015-04-27 14:05:19 -07:00

vmw_vsock

net: Remove iocb argument from sendmsg and recvmsg

2015-03-02 13:06:31 -05:00

wimax

wimax: convert printk to pr_foo()

2014-10-07 20:28:44 -04:00

wireless

cfg80211: don't allow disabling WEXT if it's required

2015-04-08 09:19:29 +02:00

x25

net: Remove iocb argument from sendmsg and recvmsg

2015-03-02 13:06:31 -05:00

xfrm

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

2015-04-14 15:44:14 -04:00

compat.c

net: switch importing msghdr from userland to {compat_,}import_iovec()

2015-04-09 00:02:26 -04:00

Kconfig

kconfig: use bool instead of boolean for type definition attributes

2015-01-07 13:08:04 +01:00

Makefile

mpls: Refactor how the mpls module is built

2015-03-04 00:26:06 -05:00

socket.c

VFS: net/: d_inode() annotations

2015-04-15 15:06:56 -04:00

sysctl_net.c

…