Adrian Moreno ee30dd2909 net: openvswitch: fix possible kfree_skb of ERR_PTR ... After the patch in the "Fixes" tag, the allocation of the "reply" skb can happen either before or after locking the ovs_mutex. However, error cleanups still follow the classical reversed order, assuming "reply" is allocated before locking: it is freed after unlocking. If "reply" allocation happens after locking the mutex and it fails, "reply" is left with an ERR_PTR, and execution jumps to the correspondent cleanup stage which will try to free an invalid pointer. Fix this by setting the pointer to NULL after having saved its error value. Fixes: 893f139b9a ("openvswitch: Minimize ovs_flow_cmd_new|set critical sections.") Signed-off-by: Adrian Moreno <amorenoz@redhat.com> Reviewed-by: Aaron Conole <aconole@redhat.com> Acked-by: Eelco Chaudron <echaudro@redhat.com> Link: https://patch.msgid.link/20260604121946.942164-1-amorenoz@redhat.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>		2026-06-08 20:13:02 -07:00
..
6lowpan	6lowpan: fix off-by-one in multicast context address compression	2026-06-01 19:10:16 -07:00
9p	9p/trans_xen: replace simple_strto* with kstrtouint	2026-04-16 02:57:01 +00:00
802	net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr	2026-06-04 08:52:41 -07:00
8021q	8021q: delete cleared egress QoS mappings	2026-04-23 12:13:57 +02:00
appletalk	appletalk: aarp: zero-initialize aarp_entry to prevent heap info leak	2026-06-03 18:08:58 -07:00
atm	net: atm: fix skb leak in sigd_send() default branch	2026-05-12 18:07:02 -07:00
batman-adv	batman-adv: bla: avoid NULL-ptr deref for claim via dropped interface	2026-05-19 10:43:54 +02:00
bluetooth	Bluetooth: MGMT: Fix backward compatibility with userspace	2026-06-03 11:24:12 -04:00
bpf	bpf: reject short IPv4/IPv6 inputs in bpf_prog_test_run_skb	2026-04-12 15:42:57 -07:00
bridge	netfilter: bridge: make ebt_snat ARP rewrite writable	2026-06-01 13:43:53 +02:00
can	Networking changes for 7.1.	2026-04-14 18:36:10 -07:00
ceph	libceph: Fix potential null-ptr-deref in decode_choose_args()	2026-05-12 21:00:59 +02:00
core	netdev: fix double-free in netdev_nl_bind_rx_doit()	2026-06-08 17:40:20 -07:00
dcb
devlink	devlink: Release nested relation on devlink free	2026-06-01 19:54:52 -07:00
dns_resolver
dsa	net: dsa: remove redundant netdev_lock_ops() from conduit ethtool ops	2026-04-16 19:10:48 -07:00
ethernet
ethtool	ethtool: eeprom: add more safeties to EEPROM Netlink fallback	2026-05-27 17:42:09 -07:00
handshake	net/handshake: Drain pending requests at net namespace exit	2026-05-28 13:35:32 +02:00
hsr	hsr: Remove WARN_ONCE() in hsr_addr_is_self().	2026-06-02 12:04:52 -07:00
ieee802154	ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit()	2026-06-04 08:51:32 -07:00
ife
ipv4	inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush	2026-06-04 18:05:23 -07:00
ipv6	ipv6: sit: reload inner IPv6 header after GSO offloads	2026-06-08 19:03:56 -07:00
iucv	net/iucv: fix locking in .getsockopt	2026-05-22 17:40:32 -07:00
kcm
key	xfrm: route MIGRATE notifications to caller's netns	2026-05-07 09:31:10 +02:00
l2tp	l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl()	2026-06-01 19:40:46 -07:00
l3mdev
lapb
llc	llc: Return -EINPROGRESS from llc_ui_connect()	2026-04-23 11:40:39 -07:00
mac80211	wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap	2026-06-02 13:26:33 +02:00
mac802154
mctp	net: mctp: test: Use dev_direct_xmit for TX to our test device	2026-04-30 13:36:47 -07:00
mpls	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2026-04-02 11:03:13 -07:00
mptcp	mptcp: add-addr: always drop other suboptions	2026-06-03 19:04:27 -07:00
ncsi
netfilter	netfilter: nft_byteorder: remove multi-register support	2026-06-01 13:43:53 +02:00
netlabel	netlabel: validate unlabeled address and mask attribute lengths	2026-06-05 19:05:06 -07:00
netlink	net: netlink: don't set nsid on local notifications	2026-05-22 17:11:09 -07:00
nfc	nfc: hci: fix out-of-bounds read in HCP header parsing	2026-05-07 12:42:09 +02:00
nsh
openvswitch	net: openvswitch: fix possible kfree_skb of ERR_PTR	2026-06-08 20:13:02 -07:00
packet	net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd()	2026-04-22 20:16:34 -07:00
phonet	net: phonet: free phonet_device after RCU grace period	2026-06-08 17:37:07 -07:00
psample
psp	psp: strip variable-length PSP header in psp_dev_rcv()	2026-05-04 19:25:14 -07:00
qrtr	net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove	2026-06-08 18:45:38 -07:00
rds	net: rds: clear i_sends on setup unwind	2026-06-02 13:31:27 -07:00
rfkill	net: rfkill: prevent unlimited numbers of rfkill events from being created	2026-04-07 12:35:04 +02:00
rxrpc	rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer	2026-05-20 16:36:45 -07:00
sched	net/sched: fix pedit partial COW leading to page cache corruption	2026-06-04 08:29:02 -07:00
sctp	sctp: purge outqueue on stale COOKIE-ECHO handling	2026-06-04 09:01:25 -07:00
shaper	net: shaper: rework the VALID marking (again)	2026-05-20 16:34:20 -07:00
smc	net/smc: Do not re-initialize smc hashtables	2026-05-22 17:38:02 -07:00
strparser	net: strparser: fix skb_head leak in strp_abort_strp()	2026-04-14 12:37:00 +02:00
sunrpc	nfsd-7.1 fixes:	2026-05-26 13:49:13 -07:00
switchdev
tipc	Including fixes from Netfilter.	2026-04-23 16:50:42 -07:00
tls	tls: Preserve sk_err across recvmsg() when data has been copied	2026-05-14 18:19:44 -07:00
unix	af_unix: Fix inq_len update problem in partial read	2026-06-03 18:52:25 -07:00
vmw_vsock	vsock/vmci: fix sk_ack_backlog leak on failed handshake	2026-06-04 13:08:02 +02:00
wireless	wifi: cfg80211: enforce HE/EHT cap/oper consistency	2026-06-03 13:25:19 +02:00
x25	vfs-7.1-rc1.kino	2026-04-13 12:19:01 -07:00
xdp	xsk: cache csum_start/csum_offset to fix TOCTOU in xsk_skb_metadata()	2026-06-03 17:45:42 -07:00
xfrm	xfrm: input: hold netns during deferred transport reinjection	2026-05-26 10:35:30 +02:00
compat.c
devres.c
Kconfig	net: remove ax25 and amateur radio (hamradio) subsystem	2026-04-23 10:24:02 -07:00
Kconfig.debug
Makefile	net: remove ax25 and amateur radio (hamradio) subsystem	2026-04-23 10:24:02 -07:00
socket.c	Networking changes for 7.1.	2026-04-14 18:36:10 -07:00
sysctl_net.c