diff options
| author | Eric Dumazet <eric.dumazet@gmail.com> | 2012-01-23 00:38:59 -0500 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2012-01-23 13:56:18 -0500 |
| commit | 4ec7ac1203bcf21f5e3d977c9818b1a56c9ef40d (patch) | |
| tree | fe3b40dad3483772426a1456adf9b75692e8056f /drivers | |
| parent | f80400a26a2e8bff541de12834a1134358bb6642 (diff) | |
macvlan: fix a possible use after free
Commit bc416d9768 (macvlan: handle fragmented multicast frames) added a
possible use after free in macvlan_handle_frame(), since
ip_check_defrag() uses pskb_may_pull() : skb header can be reallocated.
Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Cc: Ben Greear <greearb@candelatech.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/net/macvlan.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c index f2f820c4b40a..9ea99217f116 100644 --- a/drivers/net/macvlan.c +++ b/drivers/net/macvlan.c | |||
| @@ -173,6 +173,7 @@ static rx_handler_result_t macvlan_handle_frame(struct sk_buff **pskb) | |||
| 173 | skb = ip_check_defrag(skb, IP_DEFRAG_MACVLAN); | 173 | skb = ip_check_defrag(skb, IP_DEFRAG_MACVLAN); |
| 174 | if (!skb) | 174 | if (!skb) |
| 175 | return RX_HANDLER_CONSUMED; | 175 | return RX_HANDLER_CONSUMED; |
| 176 | eth = eth_hdr(skb); | ||
| 176 | src = macvlan_hash_lookup(port, eth->h_source); | 177 | src = macvlan_hash_lookup(port, eth->h_source); |
| 177 | if (!src) | 178 | if (!src) |
| 178 | /* frame comes from an external address */ | 179 | /* frame comes from an external address */ |