From patchwork Mon Oct 11 08:46:34 2010 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jiri Slaby X-Patchwork-Id: 67393 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 3BF8EB70A7 for ; Mon, 11 Oct 2010 19:47:10 +1100 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753609Ab0JKIqn (ORCPT ); Mon, 11 Oct 2010 04:46:43 -0400 Received: from mail.pripojeni.net ([217.66.174.14]:36119 "EHLO smtp.pripojeni.net" rhost-flags-OK-FAIL-OK-OK) by vger.kernel.org with ESMTP id S1753283Ab0JKIqm (ORCPT ); Mon, 11 Oct 2010 04:46:42 -0400 Received: from localhost.localdomain ([217.66.174.142]) by smtp.pripojeni.net (Kerio Connect 7.1.1); Mon, 11 Oct 2010 10:46:35 +0200 From: Jiri Slaby To: davem@davemloft.net Cc: netdev@vger.kernel.org, linux-atm-general@lists.sourceforge.net, linux-kernel@vger.kernel.org, jirislaby@gmail.com, Eric Dumazet Subject: [PATCH 1/1] ATM: mpc, fix use after free Date: Mon, 11 Oct 2010 10:46:34 +0200 Message-Id: <1286786794-10410-1-git-send-email-jslaby@suse.cz> X-Mailer: git-send-email 1.7.3.1 In-Reply-To: <1286785081.2737.2.camel@edumazet-laptop> References: <1286785081.2737.2.camel@edumazet-laptop> Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org Stanse found that mpc_push frees skb and then it dereferences it. It is a typo, new_skb should be dereferenced there. Signed-off-by: Jiri Slaby Cc: Eric Dumazet Acked-by: Eric Dumazet --- net/atm/mpc.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/net/atm/mpc.c b/net/atm/mpc.c index 622b471..74bcc66 100644 --- a/net/atm/mpc.c +++ b/net/atm/mpc.c @@ -778,7 +778,7 @@ static void mpc_push(struct atm_vcc *vcc, struct sk_buff *skb) eg->packets_rcvd++; mpc->eg_ops->put(eg); - memset(ATM_SKB(skb), 0, sizeof(struct atm_skb_data)); + memset(ATM_SKB(new_skb), 0, sizeof(struct atm_skb_data)); netif_rx(new_skb); }