netfilter: fix use-after-free in NF_HOOK_LIST
authorEdward Cree <ecree@solarflare.com>
Mon, 9 Jul 2018 17:10:02 +0000 (18:10 +0100)
committerDavid S. Miller <davem@davemloft.net>
Mon, 9 Jul 2018 21:55:53 +0000 (14:55 -0700)
commit9f17dbf04ddf55ae48f5bbafea4c4920ea943215
tree0e2468ae6bb598bdba17d3679d74c9b00a8034b6
parent8c057efaebb557b60ba514b5e39e8000a1eab0f1
netfilter: fix use-after-free in NF_HOOK_LIST

nf_hook() can free the skb, so we need to remove it from the list before
 calling, and add passed skbs to a sublist afterwards.

Fixes: 17266ee93984 ("net: ipv4: listified version of ip_rcv")
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Edward Cree <ecree@solarflare.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
include/linux/netfilter.h