macvlan: fix a possible use after free
authorEric Dumazet <eric.dumazet@gmail.com>
Mon, 23 Jan 2012 05:38:59 +0000 (05:38 +0000)
committerDavid S. Miller <davem@davemloft.net>
Mon, 23 Jan 2012 18:56:18 +0000 (13:56 -0500)
Commit bc416d9768 (macvlan: handle fragmented multicast frames) added a
possible use after free in macvlan_handle_frame(), since
ip_check_defrag() uses pskb_may_pull() : skb header can be reallocated.

Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Cc: Ben Greear <greearb@candelatech.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
drivers/net/macvlan.c

index f2f820c4b40a4fd8c3384905fb30b35dbe7c61fc..9ea99217f11609176d56459c3e35f55185e6f2af 100644 (file)
@@ -173,6 +173,7 @@ static rx_handler_result_t macvlan_handle_frame(struct sk_buff **pskb)
                skb = ip_check_defrag(skb, IP_DEFRAG_MACVLAN);
                if (!skb)
                        return RX_HANDLER_CONSUMED;
+               eth = eth_hdr(skb);
                src = macvlan_hash_lookup(port, eth->h_source);
                if (!src)
                        /* frame comes from an external address */