aboutsummaryrefslogtreecommitdiffstats
path: root/net/atm
diff options
context:
space:
mode:
authorYOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>2006-09-18 09:37:58 -0400
committerDavid S. Miller <davem@davemloft.net>2006-09-18 09:37:58 -0400
commitfe26109a9dfd9327fdbe630fc819e1b7450986b2 (patch)
treec8e2e446a2756f6c55aa8faa45de6a0f1a216f56 /net/atm
parentd7811e623dd4be3e3bdba2d6330f7f15541ee45f (diff)
[ATM] CLIP: Do not refer freed skbuff in clip_mkip().
In clip_mkip(), skb->dev is dereferenced after clip_push(), which frees up skb. Advisory: AD_LAB-06009 (<adlab@venustech.com.cn>). Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/atm')
-rw-r--r--net/atm/clip.c2
1 files changed, 2 insertions, 0 deletions
diff --git a/net/atm/clip.c b/net/atm/clip.c
index 7ce7bfe3fbad..7af2c411da82 100644
--- a/net/atm/clip.c
+++ b/net/atm/clip.c
@@ -500,9 +500,11 @@ static int clip_mkip(struct atm_vcc *vcc, int timeout)
500 } else { 500 } else {
501 unsigned int len = skb->len; 501 unsigned int len = skb->len;
502 502
503 skb_get(skb);
503 clip_push(vcc, skb); 504 clip_push(vcc, skb);
504 PRIV(skb->dev)->stats.rx_packets--; 505 PRIV(skb->dev)->stats.rx_packets--;
505 PRIV(skb->dev)->stats.rx_bytes -= len; 506 PRIV(skb->dev)->stats.rx_bytes -= len;
507 kfree_skb(skb);
506 } 508 }
507 return 0; 509 return 0;
508} 510}