Commit 095c02da authored Jun 30, 2019 by Andreas Steinmetz Committed by David S. Miller Jul 02, 2019

macsec: fix use-after-free of skb during RX



Fix use-after-free of skb when rx_handler returns RX_HANDLER_PASS.

Signed-off-by: Andreas Steinmetz <ast@domdv.de>
Acked-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent e835ada0

drivers/net/macsec.c

+2 −3

Original line number	Diff line number	Diff line
		@@ -1099,10 +1099,9 @@ static rx_handler_result_t macsec_handle_frame(struct sk_buff **pskb)
		}

		skb = skb_unshare(skb, GFP_ATOMIC);
		if (!skb) {
		*pskb = NULL;
		*pskb = skb;
		if (!skb)
		return RX_HANDLER_CONSUMED;
		}

		pulled_sci = pskb_may_pull(skb, macsec_extra_len(true));
		if (!pulled_sci) {

Admin message