]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
projects / thirdparty / kernel / stable.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: 42270cd) | patch
bridge: fix a possible use after free
authorEric Dumazet <eric.dumazet@gmail.com>
Tue, 23 Aug 2011 19:57:05 +0000 (19:57 +0000)
committerGreg Kroah-Hartman <gregkh@suse.de>
Mon, 3 Oct 2011 18:40:56 +0000 (11:40 -0700)
commitaf674335761a7ab9b015ec7e051ae232d5c0efab
tree54e6a8956a8fd62d31dffed1a79912187c75fb16tree
parent42270cd40ba8e0134cffd1c036a1aa3d844369a8commit | diff
bridge: fix a possible use after free

[ Upstream commit 22df13319d1fec30b8f9bcaadc295829647109bb ]

br_multicast_ipv6_rcv() can call pskb_trim_rcsum() and therefore skb
head can be reallocated.

Cache icmp6_type field instead of dereferencing twice the struct
icmp6hdr pointer.

Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
net/bridge/br_multicast.c diff | blob | blame | history
Mirror https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git