Patrick McHardy f9f02cca25 [NETFILTER]: nf_conntrack_ipv6: fix crash when handling fragments ...

When IPv6 connection tracking splits up a defragmented packet into
its original fragments, the packets are taken from a list and are
passed to the network stack with skb->next still set. This causes
dev_hard_start_xmit to treat them as GSO fragments, resulting in
a use after free when connection tracking handles the next fragment.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>

2007-01-09 14:32:41 -08:00

..

netfilter

[NETFILTER]: nf_conntrack_ipv6: fix crash when handling fragments

2007-01-09 14:32:41 -08:00

addrconf.c

[IPV4/IPV6]: Fix inet{,6} device initialization order.

2007-01-04 12:31:14 -08:00

af_inet6.c

[INET]: Fix incorrect "inet_sock->is_icsk" assignment.

2007-01-09 00:29:51 -08:00

ah6.c

[IPV6]: Use kmemdup

2006-12-02 21:23:58 -08:00

anycast.c

[IPV6] ADDRCONF: Convert addrconf_lock to RCU.

2006-09-22 15:20:26 -07:00

datagram.c

[IPV6]: Misc endianness annotations.

2006-12-02 21:22:52 -08:00

esp6.c

[IPV6]: 'info' argument of ipv6 ->err_handler() is net-endian

2006-12-02 21:21:12 -08:00

exthdrs_core.c

[IPV6]: Misc endianness annotations.

2006-12-02 21:22:52 -08:00

exthdrs.c

[IPV6]: Misc endianness annotations.

2006-12-02 21:22:52 -08:00

fib6_rules.c

[IPv6] rules: Remove bogus tos validation check

2006-12-02 21:22:12 -08:00

icmp.c

[NET]: Annotate callers of the reset of checksum.h stuff.

2006-12-02 21:23:34 -08:00

inet6_connection_sock.c

[IPV6]: Misc endianness annotations.

2006-12-02 21:22:52 -08:00

inet6_hashtables.c

[IPV6]: annotate inet6_hashtables

2006-12-02 21:21:10 -08:00

ip6_fib.c

[PATCH] slab: remove kmem_cache_t

2006-12-07 08:39:25 -08:00

ip6_flowlabel.c

[IPV6]: flowlabels are net-endian

2006-12-02 21:21:21 -08:00

ip6_input.c

[IPV6]: Per-interface statistics support.

2006-12-02 21:22:08 -08:00

ip6_output.c

[NET]: Convert hh_lock to seqlock.

2006-12-08 17:19:20 -08:00

ip6_tunnel.c

[IPV6]: Improve IPv6 tunnel error reporting

2006-12-02 21:30:27 -08:00

ipcomp6.c

[IPV6]: 'info' argument of ipv6 ->err_handler() is net-endian

2006-12-02 21:21:12 -08:00

ipv6_sockglue.c

[IPV6]: Fix IPV6_UNICAST_HOPS getsockopt().

2006-12-13 16:48:25 -08:00

ipv6_syms.c

[IPV6] ADDRCONF: Convert addrconf_lock to RCU.

2006-09-22 15:20:26 -07:00

Kconfig

[NET]: Rethink mark field in struct flowi

2006-12-02 21:21:39 -08:00

Makefile

[NET]: Supporting UDP-Lite (RFC 3828) in Linux

2006-12-02 21:22:46 -08:00

mcast.c

[NET]: annotate csum_ipv6_magic() callers in net/*

2006-12-02 21:23:31 -08:00

mip6.c

[IPV6]: Misc endianness annotations.

2006-12-02 21:22:52 -08:00

ndisc.c

[PATCH] sysctl: remove unused "context" param

2006-12-10 09:55:41 -08:00

netfilter.c

[NET]: Annotate __skb_checksum_complete() and friends.

2006-12-02 21:23:38 -08:00

proc.c

[NET]: Supporting UDP-Lite (RFC 3828) in Linux

2006-12-02 21:22:46 -08:00

protocol.c

Linux-2.6.12-rc2

2005-04-16 15:20:36 -07:00

raw.c

[IPV6] RAW: Don't release unlocked sock.

2006-12-06 18:39:09 -08:00

reassembly.c

[IPV6]: Misc endianness annotations.

2006-12-02 21:22:52 -08:00

route.c

[IPV6]: Make fib6_node subtree depend on IPV6_SUBTREES

2006-12-13 16:48:31 -08:00

sit.c

[IPV6] net/ipv6/sit.c: make 2 functions static

2006-12-02 21:26:15 -08:00

sysctl_net_ipv6.c

Remove obsolete #include <linux/config.h>

2006-06-30 19:25:36 +02:00

tcp_ipv6.c

[TCP]: Fix warnings with TCP_MD5SIG disabled.

2006-12-02 21:31:52 -08:00

tunnel6.c

[IPV6]: 'info' argument of ipv6 ->err_handler() is net-endian

2006-12-02 21:21:12 -08:00

udp_impl.h

[NET]: Supporting UDP-Lite (RFC 3828) in Linux

2006-12-02 21:22:46 -08:00

udp.c

[UDP(-Lite)]: consolidate v4 and v6 get|setsockopt code

2006-12-02 21:30:45 -08:00

udplite.c

[NET]: Possible cleanups.

2006-12-02 21:31:51 -08:00

xfrm6_input.c

[XFRM]: xrfm_replay_check() annotations

2006-09-28 18:02:40 -07:00

xfrm6_mode_beet.c

[XFRM]: BEET mode

2006-10-04 00:31:09 -07:00

xfrm6_mode_ro.c

[IPSEC]: output mode to take an xfrm state as input param

2006-09-22 15:18:48 -07:00

xfrm6_mode_transport.c

[IPSEC]: output mode to take an xfrm state as input param

2006-09-22 15:18:48 -07:00

xfrm6_mode_tunnel.c

[IPSEC]: output mode to take an xfrm state as input param

2006-09-22 15:18:48 -07:00

xfrm6_output.c

[IPSEC]: output mode to take an xfrm state as input param

2006-09-22 15:18:48 -07:00

xfrm6_policy.c

[NET]: Supporting UDP-Lite (RFC 3828) in Linux

2006-12-02 21:22:46 -08:00

xfrm6_state.c

[XFRM]: ports in struct xfrm_selector annotated

2006-09-28 18:02:33 -07:00

xfrm6_tunnel.c

[PATCH] slab: remove kmem_cache_t

2006-12-07 08:39:25 -08:00