* [PATCH] bridge: fix a possible use after free
@ 2011-08-24 5:57 Eric Dumazet
2011-08-25 0:50 ` David Miller
0 siblings, 1 reply; 2+ messages in thread
From: Eric Dumazet @ 2011-08-24 5:57 UTC (permalink / raw)
To: David Miller; +Cc: netdev, Herbert Xu, Stephen Hemminger
br_multicast_ipv6_rcv() can call pskb_trim_rcsum() and therefore skb
head can be reallocated.
Cache icmp6_type field instead of dereferencing twice the struct
icmp6hdr pointer.
Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
---
net/bridge/br_multicast.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
index 2d85ca7..5db95fd 100644
--- a/net/bridge/br_multicast.c
+++ b/net/bridge/br_multicast.c
@@ -1456,7 +1456,7 @@ static int br_multicast_ipv6_rcv(struct net_bridge *br,
{
struct sk_buff *skb2;
const struct ipv6hdr *ip6h;
- struct icmp6hdr *icmp6h;
+ u8 icmp6_type;
u8 nexthdr;
unsigned len;
int offset;
@@ -1502,9 +1502,9 @@ static int br_multicast_ipv6_rcv(struct net_bridge *br,
__skb_pull(skb2, offset);
skb_reset_transport_header(skb2);
- icmp6h = icmp6_hdr(skb2);
+ icmp6_type = icmp6_hdr(skb2)->icmp6_type;
- switch (icmp6h->icmp6_type) {
+ switch (icmp6_type) {
case ICMPV6_MGM_QUERY:
case ICMPV6_MGM_REPORT:
case ICMPV6_MGM_REDUCTION:
@@ -1537,7 +1537,7 @@ static int br_multicast_ipv6_rcv(struct net_bridge *br,
BR_INPUT_SKB_CB(skb)->igmp = 1;
- switch (icmp6h->icmp6_type) {
+ switch (icmp6_type) {
case ICMPV6_MGM_REPORT:
{
struct mld_msg *mld;
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] bridge: fix a possible use after free
2011-08-24 5:57 [PATCH] bridge: fix a possible use after free Eric Dumazet
@ 2011-08-25 0:50 ` David Miller
0 siblings, 0 replies; 2+ messages in thread
From: David Miller @ 2011-08-25 0:50 UTC (permalink / raw)
To: eric.dumazet; +Cc: netdev, herbert, shemminger
From: Eric Dumazet <eric.dumazet@gmail.com>
Date: Wed, 24 Aug 2011 07:57:05 +0200
> br_multicast_ipv6_rcv() can call pskb_trim_rcsum() and therefore skb
> head can be reallocated.
>
> Cache icmp6_type field instead of dereferencing twice the struct
> icmp6hdr pointer.
>
> Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Applied.
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2011-08-25 0:51 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2011-08-24 5:57 [PATCH] bridge: fix a possible use after free Eric Dumazet
2011-08-25 0:50 ` David Miller
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.