projects
/
GitHub
/
moto-9609
/
android_kernel_motorola_exynos9610.git
/ commitdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
| commitdiff |
tree
raw
|
patch
| inline |
side by side
(parent:
89087c4
)
net: qrtr: potential use after free in qrtr_sendmsg()
author
Dan Carpenter
<dan.carpenter@oracle.com>
Thu, 20 Apr 2017 10:21:30 +0000
(13:21 +0300)
committer
David S. Miller
<davem@davemloft.net>
Fri, 21 Apr 2017 19:19:27 +0000
(15:19 -0400)
If skb_pad() fails then it frees the skb so we should check for errors.
Fixes:
bdabad3e363d
("net: Add Qualcomm IPC router")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
net/qrtr/qrtr.c
patch
|
blob
|
blame
|
history
diff --git
a/net/qrtr/qrtr.c
b/net/qrtr/qrtr.c
index ae5ac175b2bef96ffa614bc799db5cd90a7bdc08..9da7368b0140f9e4a96794e21d66f487881987ba 100644
(file)
--- a/
net/qrtr/qrtr.c
+++ b/
net/qrtr/qrtr.c
@@
-658,7
+658,9
@@
static int qrtr_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
}
if (plen != len) {
- skb_pad(skb, plen - len);
+ rc = skb_pad(skb, plen - len);
+ if (rc)
+ goto out_node;
skb_put(skb, plen - len);
}