This is a note to let you know that I've just added the patch titled vxlan: fix a free after use to the 3.14-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: vxlan-fix-a-free-after-use.patch and it can be found in the queue-3.14 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From foo@baz Fri Nov 7 11:37:05 PST 2014 From: Li RongQing <roy.qing.li@xxxxxxxxx> Date: Fri, 17 Oct 2014 14:06:16 +0800 Subject: vxlan: fix a free after use From: Li RongQing <roy.qing.li@xxxxxxxxx> [ Upstream commit 7a9f526fc3ee49b6034af2f243676ee0a27dcaa8 ] pskb_may_pull maybe change skb->data and make eth pointer oboslete, so eth needs to reload Fixes: 91269e390d062 ("vxlan: using pskb_may_pull as early as possible") Cc: Eric Dumazet <edumazet@xxxxxxxxxx> Signed-off-by: Li RongQing <roy.qing.li@xxxxxxxxx> Signed-off-by: David S. Miller <davem@xxxxxxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- drivers/net/vxlan.c | 1 + 1 file changed, 1 insertion(+) --- a/drivers/net/vxlan.c +++ b/drivers/net/vxlan.c @@ -1986,6 +1986,7 @@ static netdev_tx_t vxlan_xmit(struct sk_ msg->icmph.icmp6_type == NDISC_NEIGHBOUR_SOLICITATION) return neigh_reduce(dev, skb); } + eth = eth_hdr(skb); #endif } Patches currently in stable-queue which might be from roy.qing.li@xxxxxxxxx are queue-3.14/vxlan-fix-a-use-after-free-in-vxlan_encap_bypass.patch queue-3.14/vxlan-using-pskb_may_pull-as-early-as-possible.patch queue-3.14/vxlan-fix-a-free-after-use.patch queue-3.14/ipv4-fix-a-potential-use-after-free-in-ip_tunnel_core.c.patch -- To unsubscribe from this list: send the line "unsubscribe stable" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html