A couple of bugs in skb list handling were spotted by Dan Carpenter, with the help of Smatch; following up on them I found a couple more similar cases. This series fixes them by changing the relevant loops to use the dequeue-enqueue model (rather than in-place list modification).
v3: fixed another similar bug in __netif_receive_skb_list_core(). v2: dropped patch #3 (new list.h helper), per DaveM's request. Edward Cree (3): net: core: fix uses-after-free in list processing netfilter: fix use-after-free in NF_HOOK_LIST net: core: fix use-after-free in __netif_receive_skb_list_core include/linux/netfilter.h | 10 +++++++--- net/core/dev.c | 30 ++++++++++++++++++++---------- 2 files changed, 27 insertions(+), 13 deletions(-)
