Techwizz/kernel-fxtec-pro1x
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

[NETLINK]: Fix use after free in netlink_recvmsg

Browse source 
When the user passes in MSG_TRUNC the skb is used after getting freed.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Patrick McHardy 2007-05-03 03:27:01 -07:00 committed by David S. Miller
parent 3f660d66df
commit 188ccb5583
1 changed files with 2 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
net/netlink/af_netlink.c
View file

@ -1246,16 +1246,14 @@ static int netlink_recvmsg(struct kiocb *kiocb, struct socket *sock,
siocb->scm = &scm; siocb->scm = &scm;
} }
siocb->scm->creds = *NETLINK_CREDS(skb); siocb->scm->creds = *NETLINK_CREDS(skb);
if (flags & MSG_TRUNC)
copied = skb->len;
skb_free_datagram(sk, skb); skb_free_datagram(sk, skb);
if (nlk->cb && atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf / 2) if (nlk->cb && atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf / 2)
netlink_dump(sk); netlink_dump(sk);
scm_recv(sock, msg, siocb->scm, flags); scm_recv(sock, msg, siocb->scm, flags);
if (flags & MSG_TRUNC)
copied = skb->len;
out: out:
netlink_rcv_wake(sk); netlink_rcv_wake(sk);
return err ? : copied; return err ? : copied;