Steffen Klassert 0152eee6fc xfrm: Fix NULL pointer dereference in xfrm_input when skb_dst_force clears the dst_entry. ... Since commit 222d7dbd25 ("net: prevent dst uses after free") skb_dst_force() might clear the dst_entry attached to the skb. The xfrm code doesn't expect this to happen, so we crash with a NULL pointer dereference in this case. Fix it by checking skb_dst(skb) for NULL after skb_dst_force() and drop the packet in case the dst_entry was cleared. We also move the skb_dst_force() to a codepath that is not used when the transformation was offloaded, because in this case we don't have a dst_entry attached to the skb. The output and forwarding path was already fixed by commit 9e14379378 ("xfrm: Fix NULL pointer dereference when skb_dst_force clears the dst_entry.") Fixes: 222d7dbd25 ("net: prevent dst uses after free") Reported-by: Jean-Philippe Menil <jpmenil@gmail.com> Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>		2018-11-22 10:09:39 +01:00
..
Kconfig	Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next	2018-07-27 09:33:37 -07:00
Makefile	xfrm: Add virtual xfrm interfaces	2018-06-23 16:07:25 +02:00
xfrm_algo.c
xfrm_device.c	Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next	2018-10-01 22:31:17 -07:00
xfrm_hash.c
xfrm_hash.h	xfrm: use complete IPv6 addresses for hash	2018-10-15 10:09:18 +02:00
xfrm_input.c	xfrm: Fix NULL pointer dereference in xfrm_input when skb_dst_force clears the dst_entry.	2018-11-22 10:09:39 +01:00
xfrm_interface.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2018-10-19 11:03:06 -07:00
xfrm_ipcomp.c
xfrm_output.c	xfrm: Fix error return code in xfrm_output_one()	2018-10-28 11:00:26 +01:00
xfrm_policy.c	xfrm: policy: use hlist rcu variants on insert	2018-10-11 13:24:46 +02:00
xfrm_proc.c
xfrm_replay.c
xfrm_state.c	xfrm: Fix bucket count reported to userspace	2018-11-06 12:25:47 +01:00
xfrm_sysctl.c
xfrm_user.c	net: Add extack to nlmsg_parse	2018-10-08 10:39:04 -07:00