Pablo Neira Ayuso 558b00a30e netfilter: nft_flow_offload: reset dst in route object after setting up flow ...

[ Upstream commit 9e0f0430389be7696396c62f037be4bf72cf93e3 ]

dst is transferred to the flow object, route object does not own it
anymore.  Reset dst in route object, otherwise if flow_offload_add()
fails, error path releases dst twice, leading to a refcount underflow.

Fixes: a3c90f7a23 ("netfilter: nf_tables: flow offload expression")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

2024-03-01 13:35:09 +01:00

..

6lowpan

…

9p

…

802

…

8021q

vlan: skip nested type that is not IFLA_VLAN_QOS_MAPPING

2024-01-31 16:19:01 -08:00

appletalk

…

atm

…

ax25

…

batman-adv

…

bluetooth

Bluetooth: L2CAP: Fix possible multiple reject send

2024-02-05 20:14:25 +00:00

bpf

bpf: Fix a few selftest failures due to llvm18 change

2024-02-05 20:14:20 +00:00

bpfilter

…

bridge

net: bridge: switchdev: Ensure deferred event delivery on unoffload

2024-03-01 13:35:06 +01:00

caif

…

can

can: j1939: Fix UAF in j1939_sk_match_filter during setsockopt(SO_J1939_FILTER)

2024-02-23 09:25:17 +01:00

ceph

libceph: fail sparse-read if the data length doesn't match

2024-03-01 13:34:56 +01:00

core

bpf, sockmap: Fix NULL pointer dereference in sk_psock_verdict_data_ready()

2024-03-01 13:35:08 +01:00

dcb

…

dccp

…

devlink

devlink: fix possible use-after-free and memory leaks in devlink_init()

2024-03-01 13:35:07 +01:00

dns_resolver

keys, dns: Fix size check of V1 server-list header

2024-01-25 15:35:41 -08:00

dsa

…

ethernet

…

ethtool

ethtool: netlink: Add missing ethnl_ops_begin/complete

2024-01-25 15:36:00 -08:00

handshake

net/handshake: Fix handshake_req_destroy_test1

2024-02-23 09:24:50 +01:00

hsr

net: hsr: remove WARN_ONCE() in send_hsr_supervision_frame()

2024-02-23 09:25:03 +01:00

ieee802154

…

ife

…

ipv4

arp: Prevent overflow in arp_req_get().

2024-03-01 13:35:08 +01:00

ipv6

ipv6: sr: fix possible use-after-free and null-ptr-deref

2024-03-01 13:35:07 +01:00

iucv

…

kcm

net: kcm: fix direct access to bv_len

2024-02-05 20:14:25 +00:00

key

…

l2tp

l2tp: pass correct message length to ip6_append_data

2024-03-01 13:35:01 +01:00

l3mdev

…

lapb

…

llc

llc: call sock_orphan() at release time

2024-02-05 20:14:36 +00:00

mac80211

wifi: mac80211: accept broadcast probe responses on 6 GHz

2024-03-01 13:34:55 +01:00

mac802154

…

mctp

…

mpls

…

mptcp

mptcp: fix duplicate subflow creation

2024-03-01 13:35:03 +01:00

ncsi

…

netfilter

netfilter: nft_flow_offload: reset dst in route object after setting up flow

2024-03-01 13:35:09 +01:00

netlabel

…

netlink

netlink: fix potential sleeping issue in mqueue_flush_file

2024-01-31 16:19:02 -08:00

netrom

…

nfc

nfc: nci: free rx_data_reassembly skb on NCI device cleanup

2024-02-23 09:25:02 +01:00

nsh

…

openvswitch

net: openvswitch: limit the number of recursions from action sets

2024-02-23 09:24:51 +01:00

packet

…

phonet

…

psample

…

qrtr

…

rds

net/rds: Fix UBSAN: array-index-out-of-bounds in rds_cmsg_recv

2024-01-31 16:19:01 -08:00

rfkill

…

rose

…

rxrpc

rxrpc: Fix counting of new acks and nacks

2024-02-16 19:10:50 +01:00

sched

net/sched: act_mirred: don't override retval if we already lost the skb

2024-03-01 13:35:06 +01:00

sctp

…

smc

net/smc: disable SEID on non-s390 archs where virtual ISM may be used

2024-02-05 20:14:25 +00:00

strparser

…

sunrpc

SUNRPC: Fix a suspicious RCU usage warning

2024-02-05 20:14:17 +00:00

switchdev

net: bridge: switchdev: Skip MDB replays of deferred events on offload

2024-03-01 13:35:06 +01:00

tipc

tipc: Check the bearer type before calling tipc_udp_nl_bearer_add()

2024-02-16 19:10:50 +01:00

tls

tls: don't skip over different type records from the rx_list

2024-03-01 13:35:09 +01:00

unix

af_unix: Call kfree_skb() for dead unix_(sk)->oob_skb in GC.

2024-02-16 19:10:50 +01:00

vmw_vsock

…

wireless

wifi: cfg80211: fix missing interfaces when dumping

2024-03-01 13:34:48 +01:00

x25

…

xdp

xsk: Add truesize to skb_add_rx_frag().

2024-03-01 13:35:05 +01:00

xfrm

…

compat.c

…

devres.c

…

Kconfig

…

Kconfig.debug

…

Makefile

…

socket.c

…

sysctl_net.c

…