From 4ec7ac1203bcf21f5e3d977c9818b1a56c9ef40d Mon Sep 17 00:00:00 2001 From: Eric Dumazet Date: Mon, 23 Jan 2012 05:38:59 +0000 Subject: macvlan: fix a possible use after free Commit bc416d9768 (macvlan: handle fragmented multicast frames) added a possible use after free in macvlan_handle_frame(), since ip_check_defrag() uses pskb_may_pull() : skb header can be reallocated. Signed-off-by: Eric Dumazet Cc: Ben Greear Signed-off-by: David S. Miller --- drivers/net/macvlan.c | 1 + 1 file changed, 1 insertion(+) (limited to 'drivers/net/macvlan.c') diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c index f2f820c4b40a..9ea99217f116 100644 --- a/drivers/net/macvlan.c +++ b/drivers/net/macvlan.c @@ -173,6 +173,7 @@ static rx_handler_result_t macvlan_handle_frame(struct sk_buff **pskb) skb = ip_check_defrag(skb, IP_DEFRAG_MACVLAN); if (!skb) return RX_HANDLER_CONSUMED; + eth = eth_hdr(skb); src = macvlan_hash_lookup(port, eth->h_source); if (!src) /* frame comes from an external address */ -- cgit v1.2.3