Steffen Klassert 4ddb80f419 xfrm: Fix NULL pointer dereference in xfrm_input when skb_dst_force clears the dst_entry. ... [ Upstream commit 0152eee6fc ] Since commit 222d7dbd25 ("net: prevent dst uses after free") skb_dst_force() might clear the dst_entry attached to the skb. The xfrm code doesn't expect this to happen, so we crash with a NULL pointer dereference in this case. Fix it by checking skb_dst(skb) for NULL after skb_dst_force() and drop the packet in case the dst_entry was cleared. We also move the skb_dst_force() to a codepath that is not used when the transformation was offloaded, because in this case we don't have a dst_entry attached to the skb. The output and forwarding path was already fixed by commit 9e14379378 ("xfrm: Fix NULL pointer dereference when skb_dst_force clears the dst_entry.") Fixes: 222d7dbd25 ("net: prevent dst uses after free") Reported-by: Jean-Philippe Menil <jpmenil@gmail.com> Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com> Signed-off-by: Sasha Levin <sashal@kernel.org>		2019-01-13 10:00:57 +01:00
..
Kconfig	…
Makefile	…
xfrm_algo.c	…
xfrm_device.c	…
xfrm_hash.c	…
xfrm_hash.h	…
xfrm_input.c	xfrm: Fix NULL pointer dereference in xfrm_input when skb_dst_force clears the dst_entry.	2019-01-13 10:00:57 +01:00
xfrm_ipcomp.c	…
xfrm_output.c	xfrm: Fix error return code in xfrm_output_one()	2019-01-13 10:00:57 +01:00
xfrm_policy.c	xfrm: policy: use hlist rcu variants on insert	2018-11-13 11:14:50 -08:00
xfrm_proc.c	…
xfrm_replay.c	…
xfrm_state.c	xfrm: Fix bucket count reported to userspace	2019-01-13 10:00:57 +01:00
xfrm_sysctl.c	…
xfrm_user.c	xfrm: validate template mode	2018-11-04 14:52:38 +01:00