Cong Wang 7253498cc2 netfilter: fix a use-after-free in mtype_destroy() ... commit c120959387 upstream. map->members is freed by ip_set_free() right before using it in mtype_ext_cleanup() again. So we just have to move it down. Reported-by: syzbot+4c3cc6dbe7259dbf9054@syzkaller.appspotmail.com Fixes: 40cd63bf33 ("netfilter: ipset: Support extensions which need a per data destroy function") Acked-by: Jozsef Kadlecsik <kadlec@netfilter.org> Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2020-01-23 08:22:47 +01:00
..
6lowpan	6lowpan: no need to check return value of debugfs_create functions	2019-07-06 12:50:01 +02:00
9p	9p pull request for inclusion in 5.4	2019-09-27 15:10:34 -07:00
802
8021q	vlan: vlan_changelink() should propagate errors	2020-01-12 12:21:50 +01:00
appletalk	appletalk: enforce CAP_NET_RAW for raw sockets	2019-09-24 16:37:18 +02:00
atm	net: atm: Reduce the severity of logging in unlink_clip_vcc	2019-11-18 17:08:20 -08:00
ax25	ax25: enforce CAP_NET_RAW for raw sockets	2019-09-24 16:37:18 +02:00
batman-adv	Here are two batman-adv bugfixes:	2019-10-28 16:39:07 -07:00
bluetooth	Bluetooth: Fix memory leak in hci_connect_le_scan	2020-01-09 10:20:04 +01:00
bpf	bpf/flow_dissector: support flags in BPF_PROG_TEST_RUN	2019-07-25 18:00:41 -07:00
bpfilter	Kbuild updates for v5.3	2019-07-12 16:03:16 -07:00
bridge	net: add bool confirm_neigh parameter for dst_ops.update_pmtu	2020-01-04 19:18:58 +01:00
caif	net: use skb_queue_empty_lockless() in poll() handlers	2019-10-28 13:33:41 -07:00
can	can: j1939: j1939_sk_bind(): take priv after lock is held	2019-12-31 16:45:56 +01:00
ceph	libceph: use ceph_kvmalloc() for osdmap arrays	2019-09-16 12:06:25 +02:00
core	bpf: Sockmap/tls, msg_push_data may leave end mark in place	2020-01-23 08:22:45 +01:00
dcb
dccp	net: ipv6: add net argument to ip6_dst_lookup_flow	2019-12-18 16:08:40 +01:00
decnet	net: add bool confirm_neigh parameter for dst_ops.update_pmtu	2020-01-04 19:18:58 +01:00
dns_resolver	Revert "Merge tag 'keys-acl-20190703' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs"	2019-07-10 18:43:43 -07:00
dsa	net: dsa: tag_8021q: Fix dsa_8021q_restore_pvid for an absent pvid	2019-11-16 12:23:53 -08:00
ethernet	net: add annotations on hh->hh_len lockless accesses	2020-01-09 10:20:06 +01:00
hsr	hsr: fix slab-out-of-bounds Read in hsr_debugfs_rename()	2020-01-17 19:48:32 +01:00
ieee802154	net: core: add generic lockdep keys	2019-10-24 14:53:48 -07:00
ife	net: Fix Kconfig indentation	2019-09-26 08:56:17 +02:00
ipv4	bpf/sockmap: Read psock ingress_msg before sk_receive_queue	2020-01-23 08:22:47 +01:00
ipv6	ipv6/addrconf: only check invalid header values when NETLINK_F_STRICT_CHK is set	2020-01-04 19:19:17 +01:00
iucv	net/af_iucv: mark expected switch fall-throughs	2019-07-29 10:26:14 -07:00
kcm	kcm: disable preemption in kcm_parse_func_strparser()	2019-09-27 10:27:14 +02:00
key	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2019-07-08 19:48:57 -07:00
l2tp	net: ipv6: add net argument to ip6_dst_lookup_flow	2019-12-18 16:08:40 +01:00
l3mdev
lapb
llc	llc2: Fix return statement of llc_stat_ev_rx_null_dsap_xid_c (and _test_c)	2020-01-12 12:21:45 +01:00
mac80211	mac80211: fix TID field in monitor mode transmit	2020-01-12 12:21:28 +01:00
mac802154
mpls	net: ipv6_stub: use ip6_dst_lookup_flow instead of ip6_dst_lookup	2019-12-18 16:08:42 +01:00
ncsi	net/ncsi: Disable global multicast filter	2019-09-19 18:04:40 -07:00
netfilter	netfilter: fix a use-after-free in mtype_destroy()	2020-01-23 08:22:47 +01:00
netlabel	netlabel: remove redundant assignment to pointer iter	2019-09-01 11:45:02 -07:00
netlink
netrom	net: core: add generic lockdep keys	2019-10-24 14:53:48 -07:00
nfc	net: nfc: nci: fix a possible sleep-in-atomic-context bug in nci_uart_tty_receive()	2019-12-31 16:41:23 +01:00
nsh
openvswitch	net: Fixed updating of ethertype in skb_mpls_push()	2019-12-18 16:08:56 +01:00
packet	af_packet: set defaule value for tmo	2019-12-31 16:41:12 +01:00
phonet	net: use skb_queue_empty_lockless() in poll() handlers	2019-10-28 13:33:41 -07:00
psample	net: psample: fix skb_over_panic	2019-12-04 22:30:54 +01:00
qrtr	net: qrtr: Stop rx_worker before freeing node	2019-09-21 18:45:46 -07:00
rds	rds: ib: update WR sizes when bringing up connection	2019-11-16 12:59:08 -08:00
rfkill	rfkill: Fix incorrect check to avoid NULL pointer dereference	2020-01-12 12:21:33 +01:00
rose	net: core: add generic lockdep keys	2019-10-24 14:53:48 -07:00
rxrpc	rxrpc: Fix missing security check on incoming calls	2020-01-17 19:49:05 +01:00
sched	sch_cake: Add missing NLA policy entry TCA_CAKE_SPLIT_GSO	2020-01-17 19:49:02 +01:00
sctp	sctp: free cmd->obj.chunk for the unprocessed SCTP_CMD_REPLY	2020-01-12 12:21:48 +01:00
smc	net/smc: add fallback check to connect()	2020-01-04 19:18:37 +01:00
strparser
sunrpc	xprtrdma: Fix oops in Receive handler after device removal	2020-01-17 19:48:44 +01:00
switchdev
tipc	tipc: fix retrans failure due to wrong destination	2020-01-23 08:22:44 +01:00
tls	bpf: Sockmap/tls, fix pop data with SK_DROP return code	2020-01-23 08:22:46 +01:00
unix	af_unix: add compat_ioctl support	2020-01-17 19:48:52 +01:00
vmw_vsock	vsock/virtio: fix sock refcnt holding during the shutdown	2019-11-08 12:17:50 -08:00
wimax	wimax: no need to check return value of debugfs_create functions	2019-08-10 15:25:47 -07:00
wireless	cfg80211: fix page refcount issue in A-MSDU decap	2020-01-23 08:22:47 +01:00
x25	net: silence KCSAN warnings around sk_add_backlog() calls	2019-10-09 21:42:59 -07:00
xdp	xsk: Add rcu_read_lock around the XSK wakeup	2020-01-12 12:21:41 +01:00
xfrm	xfrm: release device reference for invalid state	2019-11-12 08:24:38 +01:00
compat.c
Kconfig	devlink: Add packet trap infrastructure	2019-08-17 12:40:08 -07:00
Makefile
socket.c	compat_ioctl: handle SIOCOUTQNSD	2020-01-17 19:48:52 +01:00
sysctl_net.c