ATM: mpc, fix use after free
Stanse found that mpc_push frees skb and then it dereferences it. It is a typo, new_skb should be dereferenced there. Signed-off-by: Jiri Slaby <jslaby@suse.cz> Cc: Eric Dumazet <eric.dumazet@gmail.com> Acked-by: Eric Dumazet <eric.dumazet@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Родитель
f1ee89d5b0
Коммит
5518b29f22
|
@ -778,7 +778,7 @@ static void mpc_push(struct atm_vcc *vcc, struct sk_buff *skb)
|
|||
eg->packets_rcvd++;
|
||||
mpc->eg_ops->put(eg);
|
||||
|
||||
memset(ATM_SKB(skb), 0, sizeof(struct atm_skb_data));
|
||||
memset(ATM_SKB(new_skb), 0, sizeof(struct atm_skb_data));
|
||||
netif_rx(new_skb);
|
||||
}
|
||||
|
||||
|
|
Загрузка…
Ссылка в новой задаче