diff options
| author | Patrick McHardy <kaber@trash.net> | 2007-05-03 03:27:01 -0700 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2007-05-03 03:27:01 -0700 |
| commit | 188ccb5583b8f501e1d0f5ba4f056afa141694e7 (patch) | |
| tree | 3df30fcc6e333048517e79a3ec3a49b98617f447 /net/netlink | |
| parent | 3f660d66dfbc13ea4b61d3865851b348444c24b4 (diff) | |
[NETLINK]: Fix use after free in netlink_recvmsg
When the user passes in MSG_TRUNC the skb is used after getting freed.
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/netlink')
| -rw-r--r-- | net/netlink/af_netlink.c | 6 |
1 files changed, 2 insertions, 4 deletions
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c index 7fc6b4da4f02..ac1ceadf4ed3 100644 --- a/net/netlink/af_netlink.c +++ b/net/netlink/af_netlink.c @@ -1246,16 +1246,14 @@ static int netlink_recvmsg(struct kiocb *kiocb, struct socket *sock, siocb->scm = &scm; } siocb->scm->creds = *NETLINK_CREDS(skb); + if (flags & MSG_TRUNC) + copied = skb->len; skb_free_datagram(sk, skb); if (nlk->cb && atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf / 2) netlink_dump(sk); scm_recv(sock, msg, siocb->scm, flags); - - if (flags & MSG_TRUNC) - copied = skb->len; - out: netlink_rcv_wake(sk); return err ? : copied; |