diff options
| author | Jakub Kicinski <kuba@kernel.org> | 2024-09-09 17:14:28 -0700 |
|---|---|---|
| committer | Jakub Kicinski <kuba@kernel.org> | 2024-09-09 17:14:29 -0700 |
| commit | 228fa9b1e86d13b4031f18793048643384eb4e51 (patch) | |
| tree | bce056075dd45e981c19074a4577abf591dcf0ab /drivers/net/ethernet/atheros | |
| parent | e4225a8c46ec7109fdf2e2ce6f92e52b25cb2363 (diff) | |
| parent | 5aa57d9f2d5311f19434d95b2a81610aa263e23b (diff) | |
Merge branch 'af_unix-correct-manage_oob-when-oob-follows-a-consumed-oob'
Kuniyuki Iwashima says:
====================
af_unix: Correct manage_oob() when OOB follows a consumed OOB.
Recently syzkaller reported UAF of OOB skb.
The bug was introduced by commit 93c99f21db36 ("af_unix: Don't stop
recv(MSG_DONTWAIT) if consumed OOB skb is at the head.") but uncovered
by another recent commit 8594d9b85c07 ("af_unix: Don't call skb_get()
for OOB skb.").
[0]: https://lore.kernel.org/netdev/00000000000083b05a06214c9ddc@google.com/
====================
Link: https://patch.msgid.link/20240905193240.17565-1-kuniyu@amazon.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Diffstat (limited to 'drivers/net/ethernet/atheros')
0 files changed, 0 insertions, 0 deletions