Gitweb:     
http://git.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=188ccb5583b8f501e1d0f5ba4f056afa141694e7
Commit:     188ccb5583b8f501e1d0f5ba4f056afa141694e7
Parent:     3f660d66dfbc13ea4b61d3865851b348444c24b4
Author:     Patrick McHardy <[EMAIL PROTECTED]>
AuthorDate: Thu May 3 03:27:01 2007 -0700
Committer:  David S. Miller <[EMAIL PROTECTED]>
CommitDate: Thu May 3 03:27:01 2007 -0700

    [NETLINK]: Fix use after free in netlink_recvmsg
    
    When the user passes in MSG_TRUNC the skb is used after getting freed.
    
    Signed-off-by: Patrick McHardy <[EMAIL PROTECTED]>
    Signed-off-by: David Howells <[EMAIL PROTECTED]>
    Signed-off-by: David S. Miller <[EMAIL PROTECTED]>
---
 net/netlink/af_netlink.c |    6 ++----
 1 files changed, 2 insertions(+), 4 deletions(-)

diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index 7fc6b4d..ac1cead 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -1246,16 +1246,14 @@ static int netlink_recvmsg(struct kiocb *kiocb, struct 
socket *sock,
                siocb->scm = &scm;
        }
        siocb->scm->creds = *NETLINK_CREDS(skb);
+       if (flags & MSG_TRUNC)
+               copied = skb->len;
        skb_free_datagram(sk, skb);
 
        if (nlk->cb && atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf / 2)
                netlink_dump(sk);
 
        scm_recv(sock, msg, siocb->scm, flags);
-
-       if (flags & MSG_TRUNC)
-               copied = skb->len;
-
 out:
        netlink_rcv_wake(sk);
        return err ? : copied;
-
To unsubscribe from this list: send the line "unsubscribe git-commits-head" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Reply via email to