summaryrefslogtreecommitdiffstats
path: root/net/ipv6
diff options
context:
space:
mode:
authorDaniel Borkmann <dborkman@redhat.com>2013-12-30 23:40:50 +0100
committerDavid S. Miller <davem@davemloft.net>2014-01-03 01:31:09 +0100
commit4d231b76eef6c4a6bd9c96769e191517765942cb (patch)
treeae855d6ce8a7d2c67f13e2ab9f9376dc6b2e315d /net/ipv6
parentvirtio-net: fix refill races during restore (diff)
downloadlinux-4d231b76eef6c4a6bd9c96769e191517765942cb.tar.xz
linux-4d231b76eef6c4a6bd9c96769e191517765942cb.zip
net: llc: fix use after free in llc_ui_recvmsg
While commit 30a584d944fb fixes datagram interface in LLC, a use after free bug has been introduced for SOCK_STREAM sockets that do not make use of MSG_PEEK. The flow is as follow ... if (!(flags & MSG_PEEK)) { ... sk_eat_skb(sk, skb, false); ... } ... if (used + offset < skb->len) continue; ... where sk_eat_skb() calls __kfree_skb(). Therefore, cache original length and work on skb_len to check partial reads. Fixes: 30a584d944fb ("[LLX]: SOCK_DGRAM interface fixes") Signed-off-by: Daniel Borkmann <dborkman@redhat.com> Cc: Stephen Hemminger <stephen@networkplumber.org> Cc: Arnaldo Carvalho de Melo <acme@ghostprotocols.net> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/ipv6')
0 files changed, 0 insertions, 0 deletions