diff options
| author | YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org> | 2006-09-18 06:37:58 -0700 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2006-09-18 06:37:58 -0700 |
| commit | fe26109a9dfd9327fdbe630fc819e1b7450986b2 (patch) | |
| tree | c8e2e446a2756f6c55aa8faa45de6a0f1a216f56 /net/atm/clip.c | |
| parent | d7811e623dd4be3e3bdba2d6330f7f15541ee45f (diff) | |
[ATM] CLIP: Do not refer freed skbuff in clip_mkip().
In clip_mkip(), skb->dev is dereferenced after clip_push(),
which frees up skb.
Advisory: AD_LAB-06009 (<adlab@venustech.com.cn>).
Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/atm/clip.c')
| -rw-r--r-- | net/atm/clip.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/net/atm/clip.c b/net/atm/clip.c index 7ce7bfe3fbad..7af2c411da82 100644 --- a/net/atm/clip.c +++ b/net/atm/clip.c @@ -500,9 +500,11 @@ static int clip_mkip(struct atm_vcc *vcc, int timeout) } else { unsigned int len = skb->len; + skb_get(skb); clip_push(vcc, skb); PRIV(skb->dev)->stats.rx_packets--; PRIV(skb->dev)->stats.rx_bytes -= len; + kfree_skb(skb); } return 0; } |