linux-fsdevel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* [PATCH 1/5] [NETLINK]: Fix use after free in netlink_recvmsg
@ 2007-05-03  9:53 David Howells
  2007-05-03  9:53 ` [PATCH 2/5] [AFS]: Fix memory leak in SRXAFSCB_GetCapabilities David Howells
                   ` (4 more replies)
  0 siblings, 5 replies; 13+ messages in thread
From: David Howells @ 2007-05-03  9:53 UTC (permalink / raw)
  To: akpm; +Cc: linux-kernel, linux-fsdevel, netdev, kaber, dhowells

When the user passes in MSG_TRUNC the skb is used after getting freed.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David Howells <dhowells@redhat.com>
---

 net/netlink/af_netlink.c |    6 ++----
 1 files changed, 2 insertions(+), 4 deletions(-)

diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index 42d2fb9..7419f70 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -1245,16 +1245,14 @@ static int netlink_recvmsg(struct kiocb *kiocb, struct socket *sock,
 		siocb->scm = &scm;
 	}
 	siocb->scm->creds = *NETLINK_CREDS(skb);
+	if (flags & MSG_TRUNC)
+		copied = skb->len;
 	skb_free_datagram(sk, skb);
 
 	if (nlk->cb && atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf / 2)
 		netlink_dump(sk);
 
 	scm_recv(sock, msg, siocb->scm, flags);
-
-	if (flags & MSG_TRUNC)
-		copied = skb->len;
-
 out:
 	netlink_rcv_wake(sk);
 	return err ? : copied;


^ permalink raw reply related	[flat|nested] 13+ messages in thread

end of thread, other threads:[~2007-05-03 20:11 UTC | newest]

Thread overview: 13+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2007-05-03  9:53 [PATCH 1/5] [NETLINK]: Fix use after free in netlink_recvmsg David Howells
2007-05-03  9:53 ` [PATCH 2/5] [AFS]: Fix memory leak in SRXAFSCB_GetCapabilities David Howells
2007-05-03 10:27   ` David Miller
2007-05-03  9:53 ` [PATCH 3/5] [NET]: Add __dev_getfirstbyhwtype David Howells
2007-05-03 10:28   ` David Miller
2007-05-03  9:53 ` [PATCH 4/5] [AFS]: Replace rtnetlink client by direct dev_base walking David Howells
2007-05-03 10:28   ` David Miller
2007-05-03  9:53 ` [PATCH 5/5] AFS: Adjust the new netdevice scanning code David Howells
2007-05-03 10:29   ` David Miller
2007-05-03 10:27 ` [PATCH 1/5] [NETLINK]: Fix use after free in netlink_recvmsg David Miller
2007-05-03 12:27   ` Marcel Holtmann
2007-05-03 12:46     ` Patrick McHardy
2007-05-03 20:11     ` David Miller

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).