TWxSoftware/twx-linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[ATM] CLIP: Do not refer freed skbuff in clip_mkip() (CVE-2006-4997)

Browse Source 
In clip_mkip(), skb->dev is dereferenced after clip_push(),
which frees up skb.

Advisory: AD_LAB-06009 (<adlab@venustech.com.cn>).

Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
This commit is contained in:
YOSHIFUJI Hideaki
2006-10-14 01:13:36 +02:00
committed by Adrian Bunk
parent 601c7cf725
commit cffa5ffe72
1 changed files with 2 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
net/atm/clip.c
+2
View File
@@ -507,9 +507,11 @@ static int clip_mkip(struct atm_vcc *vcc,int timeout)
else {
unsigned int len = skb->len;
skb_get(skb);
clip_push(vcc,skb);
PRIV(skb->dev)->stats.rx_packets--;
PRIV(skb->dev)->stats.rx_bytes -= len;
kfree_skb(skb);
}
return 0;
}