summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorEric Dumazet <eric.dumazet@gmail.com>2012-01-23 05:38:59 +0000
committerDavid S. Miller <davem@davemloft.net>2012-01-23 13:56:18 -0500
commit4ec7ac1203bcf21f5e3d977c9818b1a56c9ef40d (patch)
treefe3b40dad3483772426a1456adf9b75692e8056f
parentf80400a26a2e8bff541de12834a1134358bb6642 (diff)
macvlan: fix a possible use after free
Commit bc416d9768 (macvlan: handle fragmented multicast frames) added a possible use after free in macvlan_handle_frame(), since ip_check_defrag() uses pskb_may_pull() : skb header can be reallocated. Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com> Cc: Ben Greear <greearb@candelatech.com> Signed-off-by: David S. Miller <davem@davemloft.net>
-rw-r--r--drivers/net/macvlan.c1
1 files changed, 1 insertions, 0 deletions
diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c
index f2f820c4b40a..9ea99217f116 100644
--- a/drivers/net/macvlan.c
+++ b/drivers/net/macvlan.c
@@ -173,6 +173,7 @@ static rx_handler_result_t macvlan_handle_frame(struct sk_buff **pskb)
skb = ip_check_defrag(skb, IP_DEFRAG_MACVLAN);
if (!skb)
return RX_HANDLER_CONSUMED;
+ eth = eth_hdr(skb);
src = macvlan_hash_lookup(port, eth->h_source);
if (!src)
/* frame comes from an external address */