]> git.baikalelectronics.ru Git - kernel.git/commit
projects / kernel.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: cd1956d) | patch
bridge: fix a possible use after free
authorEric Dumazet <eric.dumazet@gmail.com>
Tue, 23 Aug 2011 19:57:05 +0000 (19:57 +0000)
committerDavid S. Miller <davem@davemloft.net>
Thu, 25 Aug 2011 00:49:24 +0000 (17:49 -0700)
commit0fca0c37592459634c4fcc275d8b51385273bdb2
treeb61441ea39ac3c525746bfe8aaab9b6b5f9c6c63tree | snapshot
parentcd1956d01530d18de23f4631d0eebf19ff41ea88commit | diff
bridge: fix a possible use after free

br_multicast_ipv6_rcv() can call pskb_trim_rcsum() and therefore skb
head can be reallocated.

Cache icmp6_type field instead of dereferencing twice the struct
icmp6hdr pointer.

Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
net/bridge/br_multicast.c diff | blob | history
Linux Kernel Source Tree.