diff options
| author | Herbert Xu <herbert@gondor.apana.org.au> | 2016-06-01 11:43:00 +0800 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2016-06-01 17:48:46 -0700 |
| commit | 260916dfb48c374f7840f3b86e69afd3afdb6e96 (patch) | |
| tree | f3d2d75d159a68ee886d04cd130d05107f388bbd /fs/cramfs | |
| parent | 595d0b29463343c3be995d3948930b8231e5b8cd (diff) | |
macvlan: Fix potential use-after free for broadcasts
When we postpone a broadcast packet we save the source port in
the skb if it is local. However, the source port can disappear
before we get a chance to process the packet.
This patch fixes this by holding a ref count on the netdev.
It also delays the skb->cb modification until after we allocate
the new skb as you should not modify shared skbs.
Fixes: 412ca1550cbe ("macvlan: Move broadcasts into a work queue")
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'fs/cramfs')
0 files changed, 0 insertions, 0 deletions