Messages in this thread Patch in this message | | | From | Jiri Slaby <> | Subject | [PATCH 1/1] ATM: mpc, fix use after free | Date | Mon, 11 Oct 2010 10:46:34 +0200 |
| |
Stanse found that mpc_push frees skb and then it dereferences it. It is a typo, new_skb should be dereferenced there.
Signed-off-by: Jiri Slaby <jslaby@suse.cz> Cc: Eric Dumazet <eric.dumazet@gmail.com> --- net/atm/mpc.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/net/atm/mpc.c b/net/atm/mpc.c index 622b471..74bcc66 100644 --- a/net/atm/mpc.c +++ b/net/atm/mpc.c @@ -778,7 +778,7 @@ static void mpc_push(struct atm_vcc *vcc, struct sk_buff *skb) eg->packets_rcvd++; mpc->eg_ops->put(eg); - memset(ATM_SKB(skb), 0, sizeof(struct atm_skb_data)); + memset(ATM_SKB(new_skb), 0, sizeof(struct atm_skb_data)); netif_rx(new_skb); } -- 1.7.3.1
| |