Skip to content

Commit

Permalink
ATM: mpc, fix use after free
Browse files Browse the repository at this point in the history
Stanse found that mpc_push frees skb and then it dereferences it. It
is a typo, new_skb should be dereferenced there.

Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Cc: Eric Dumazet <eric.dumazet@gmail.com>
Acked-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
  • Loading branch information
Jiri Slaby authored and David S. Miller committed Oct 11, 2010
1 parent f1ee89d commit 5518b29
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion net/atm/mpc.c
Original file line number Diff line number Diff line change
Expand Up @@ -778,7 +778,7 @@ static void mpc_push(struct atm_vcc *vcc, struct sk_buff *skb)
eg->packets_rcvd++;
mpc->eg_ops->put(eg);

memset(ATM_SKB(skb), 0, sizeof(struct atm_skb_data));
memset(ATM_SKB(new_skb), 0, sizeof(struct atm_skb_data));
netif_rx(new_skb);
}

Expand Down

0 comments on commit 5518b29

Please sign in to comment.