public-mirrors/linux
1
0
Fork 0
mirror of git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2025-09-18 22:14:16 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

[ATM] CLIP: Do not refer freed skbuff in clip_mkip().

Browse source 
In clip_mkip(), skb->dev is dereferenced after clip_push(),
which frees up skb.

Advisory: AD_LAB-06009 (<adlab@venustech.com.cn>).

Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
YOSHIFUJI Hideaki 2006-09-18 06:37:58 -07:00 • committed by David S. Miller
parent d7811e623d
commit fe26109a9d
1 changed files with 2 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
net/atm/clip.c
View file

@ -500,9 +500,11 @@ static int clip_mkip(struct atm_vcc *vcc, int timeout)
} else {
unsigned int len = skb->len;
skb_get(skb);
clip_push(vcc, skb);
PRIV(skb->dev)->stats.rx_packets--;
PRIV(skb->dev)->stats.rx_bytes -= len;
kfree_skb(skb);
}
return 0;
}