| From 33cdb9c9c280982858a98c47233912050209aaa5 Mon Sep 17 00:00:00 2001 |
| From: Eric Dumazet <eric.dumazet@gmail.com> |
| Date: Mon, 23 Jan 2012 05:38:59 +0000 |
| Subject: macvlan: fix a possible use after free |
| |
| |
| From: Eric Dumazet <eric.dumazet@gmail.com> |
| |
| [ Upstream commit 4ec7ac1203bcf21f5e3d977c9818b1a56c9ef40d ] |
| |
| Commit bc416d9768 (macvlan: handle fragmented multicast frames) added a |
| possible use after free in macvlan_handle_frame(), since |
| ip_check_defrag() uses pskb_may_pull() : skb header can be reallocated. |
| |
| Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com> |
| Cc: Ben Greear <greearb@candelatech.com> |
| Signed-off-by: David S. Miller <davem@davemloft.net> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| --- |
| drivers/net/macvlan.c | 1 + |
| 1 file changed, 1 insertion(+) |
| |
| --- a/drivers/net/macvlan.c |
| +++ b/drivers/net/macvlan.c |
| @@ -172,6 +172,7 @@ static rx_handler_result_t macvlan_handl |
| skb = ip_check_defrag(skb, IP_DEFRAG_MACVLAN); |
| if (!skb) |
| return RX_HANDLER_CONSUMED; |
| + eth = eth_hdr(skb); |
| src = macvlan_hash_lookup(port, eth->h_source); |
| if (!src) |
| /* frame comes from an external address */ |
