diff options
author | YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org> | 2006-09-18 13:37:58 (GMT) |
---|---|---|
committer | David S. Miller <davem@davemloft.net> | 2006-09-18 13:37:58 (GMT) |
commit | fe26109a9dfd9327fdbe630fc819e1b7450986b2 (patch) | |
tree | c8e2e446a2756f6c55aa8faa45de6a0f1a216f56 | |
parent | d7811e623dd4be3e3bdba2d6330f7f15541ee45f (diff) | |
download | linux-fsl-qoriq-fe26109a9dfd9327fdbe630fc819e1b7450986b2.tar.xz |
[ATM] CLIP: Do not refer freed skbuff in clip_mkip().
In clip_mkip(), skb->dev is dereferenced after clip_push(),
which frees up skb.
Advisory: AD_LAB-06009 (<adlab@venustech.com.cn>).
Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
-rw-r--r-- | net/atm/clip.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/net/atm/clip.c b/net/atm/clip.c index 7ce7bfe..7af2c41 100644 --- a/net/atm/clip.c +++ b/net/atm/clip.c @@ -500,9 +500,11 @@ static int clip_mkip(struct atm_vcc *vcc, int timeout) } else { unsigned int len = skb->len; + skb_get(skb); clip_push(vcc, skb); PRIV(skb->dev)->stats.rx_packets--; PRIV(skb->dev)->stats.rx_bytes -= len; + kfree_skb(skb); } return 0; } |