David Howells 3740a6078d rxrpc: Fix NULL pointer deref due to call->conn being cleared on disconnect ... [ Upstream commit 5273a191dc ] When a call is disconnected, the connection pointer from the call is cleared to make sure it isn't used again and to prevent further attempted transmission for the call. Unfortunately, there might be a daemon trying to use it at the same time to transmit a packet. Fix this by keeping call->conn set, but setting a flag on the call to indicate disconnection instead. Remove also the bits in the transmission functions where the conn pointer is checked and a ref taken under spinlock as this is now redundant. Fixes: 8d94aa381d ("rxrpc: Calls shouldn't hold socket refs") Signed-off-by: David Howells <dhowells@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2020-02-14 16:32:07 -05:00
..
6lowpan	6lowpan: Off by one handling ->nexthdr	2020-01-27 14:46:30 +01:00
9p	9p/virtio: Add cleanup path in p9_virtio_init	2019-07-31 07:28:39 +02:00
802
8021q	vlan: fix memory leak in vlan_dev_set_egress_priority	2020-01-12 12:12:09 +01:00
appletalk	appletalk: Set error code if register_snap_client failed	2019-12-17 20:38:59 +01:00
atm	net: use skb_queue_empty_lockless() in poll() handlers	2019-11-10 11:25:34 +01:00
ax25	ax25: enforce CAP_NET_RAW for raw sockets	2019-10-05 12:47:43 +02:00
batman-adv	batman-adv: Fix DAT candidate selection on little endian systems	2020-01-23 08:20:34 +01:00
bluetooth	Bluetooth: Fix race condition in hci_release_sock()	2020-02-05 14:18:16 +00:00
bpf
bridge	netfilter: ebtables: CONFIG_COMPAT: reject trailing data after last rule	2020-01-27 14:46:34 +01:00
caif	net: use skb_queue_empty_lockless() in poll() handlers	2019-11-10 11:25:34 +01:00
can	can: af_can: Fix error path of can_init()	2019-07-21 09:04:22 +02:00
ceph	libceph: fix PG split vs OSD (re)connect race	2019-08-29 08:26:42 +02:00
core	net: Fix skb->csum update in inet_proto_csum_replace16().	2020-02-05 14:18:28 +00:00
dcb	net: dcb: For wild-card lookups, use priority -1, not 0	2018-09-19 22:43:43 +02:00
dccp	dccp: Fix memleak in __feat_register_sp	2020-01-17 19:45:43 +01:00
decnet	net: add bool confirm_neigh parameter for dst_ops.update_pmtu	2020-01-04 14:00:14 +01:00
dns_resolver	KEYS: DNS: fix parsing multiple options	2018-07-22 14:28:49 +02:00
dsa	net: dsa: tag_qca: fix doubled Tx statistics	2020-01-23 08:20:34 +01:00
ethernet	net: add annotations on hh->hh_len lockless accesses	2020-01-09 10:17:59 +01:00
hsr	net: hsr: fix possible NULL deref in hsr_handle_frame()	2020-02-14 16:32:06 -05:00
ieee802154	inet: frags: call inet_frags_fini() after unregister_pernet_subsys()	2020-01-27 14:46:36 +01:00
ife	net: sched: ife: check on metadata length	2018-04-29 11:33:13 +02:00
ipv4	tcp: clear tp->segs_{in|out} in tcp_disconnect()	2020-02-14 16:32:07 -05:00
ipv6	vti[6]: fix packet tx through bpf_redirect()	2020-02-05 14:18:23 +00:00
ipx
iucv	net/af_iucv: always register net_device notifier	2020-01-27 14:46:38 +01:00
kcm	kcm: switch order of device registration to fix a crash	2019-04-17 08:37:45 +02:00
key	xfrm: clean up xfrm protocol checks	2019-09-16 08:20:44 +02:00
l2tp	l2tp: Allow duplicate session creation with UDP	2020-02-14 16:32:06 -05:00
l3mdev
lapb	lapb: fixed leak of control-blocks.	2019-06-22 08:16:14 +02:00
llc	llc: fix sk_buff refcounting in llc_conn_state_process()	2020-01-27 14:46:49 +01:00
mac80211	mac80211: Fix TKIP replay protection immediately after key setup	2020-02-05 14:18:21 +00:00
mac802154	net: mac802154: tx: expand tailroom if necessary	2018-09-09 19:55:52 +02:00
mpls	mpls: fix warning with multi-label encap	2020-01-27 14:46:37 +01:00
ncsi
netfilter	netfilter: ipset: use bitmap infrastructure completely	2020-01-29 15:02:39 +01:00
netlabel	netlabel: fix out-of-bounds memory accesses	2019-03-13 14:03:08 -07:00
netlink	genetlink: Fix a memory leak on error path	2019-04-03 06:25:08 +02:00
netrom	netrom: hold sock when setting skb->destructor	2019-07-31 07:28:46 +02:00
nfc	net: nfc: nci: fix a possible sleep-in-atomic-context bug in nci_uart_tty_receive()	2019-12-31 12:36:41 +01:00
nsh	nsh: set mac len based on inner packet	2018-07-22 14:28:49 +02:00
openvswitch	openvswitch: support asymmetric conntrack	2019-12-21 10:47:34 +01:00
packet	packet: fix data-race in fanout_flow_is_huge()	2020-01-27 14:46:51 +01:00
phonet	net: use skb_queue_empty_lockless() in poll() handlers	2019-11-10 11:25:34 +01:00
psample	net: psample: fix skb_over_panic	2019-12-05 15:38:15 +01:00
qrtr	net: qrtr: Stop rx_worker before freeing node	2019-10-05 12:47:40 +02:00
rds	net/rds: Fix 'ib_evt_handler_call' element in 'rds_ib_stat_names'	2020-01-27 14:46:47 +01:00
rfkill	rfkill: Fix incorrect check to avoid NULL pointer dereference	2020-01-12 12:11:57 +01:00
rose	net/rose: fix unbound loop in rose_loopback_timer()	2019-05-02 09:40:34 +02:00
rxrpc	rxrpc: Fix NULL pointer deref due to call->conn being cleared on disconnect	2020-02-14 16:32:07 -05:00
sched	net_sched: fix an OOB access in cls_tcindex	2020-02-14 16:32:06 -05:00
sctp	sctp: free cmd->obj.chunk for the unprocessed SCTP_CMD_REPLY	2020-01-12 12:12:07 +01:00
smc	net/smc: use after free fix in smc_wr_tx_put_slot()	2019-12-17 20:38:01 +01:00
strparser	strparser: Remove early eaten to fix full tcp receive buffer stall	2018-07-22 14:28:47 +02:00
sunrpc	xprtrdma: Fix completion wait during device removal	2020-01-17 19:45:47 +01:00
switchdev
tipc	tipc: reduce risk of wakeup queue starvation	2020-01-27 14:46:41 +01:00
tls	net/tls: Fixed return value when tls_complete_pending_work() fails	2018-12-05 19:41:11 +01:00
unix	af_unix: add compat_ioctl support	2020-01-17 19:45:49 +01:00
vmw_vsock	VSOCK: bind to random port for VMADDR_PORT_ANY	2019-12-05 15:37:24 +01:00
wimax
wireless	wireless: wext: avoid gcc -O3 warning	2020-02-05 14:18:22 +00:00
x25	net/x25: fix nonblocking connect	2020-01-29 15:02:39 +01:00
xfrm	xfrm: release device reference for invalid state	2019-12-17 20:37:28 +01:00
compat.c	sock: Make sock->sk_stamp thread-safe	2019-01-09 17:14:46 +01:00
Kconfig
Makefile
socket.c	compat_ioctl: handle SIOCOUTQNSD	2020-01-17 19:45:49 +01:00
sysctl_net.c