From: David S. Miller <davem@davemloft.net>
Date: Mon, 9 Jul 2018 21:55:54 +0000 (-0700)
Subject: Merge branch 'fix-use-after-free-bugs-in-skb-list-processing'
X-Git-Url: http://git.maquefel.me/?a=commitdiff_plain;h=863f4fdb715c3328d4ff1ed547c5508c8e6e2b06;p=linux.git

Merge branch 'fix-use-after-free-bugs-in-skb-list-processing'

Edward Cree says:

====================
fix use-after-free bugs in skb list processing

A couple of bugs in skb list handling were spotted by Dan Carpenter, with
 the help of Smatch; following up on them I found a couple more similar
 cases.  This series fixes them by changing the relevant loops to use the
 dequeue-enqueue model (rather than in-place list modification).

v3: fixed another similar bug in __netif_receive_skb_list_core().

v2: dropped patch #3 (new list.h helper), per DaveM's request.
====================

Signed-off-by: David S. Miller <davem@davemloft.net>
---

863f4fdb715c3328d4ff1ed547c5508c8e6e2b06