Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 88fae873 authored by Michael S. Tsirkin's avatar Michael S. Tsirkin Committed by David S. Miller
Browse files

tap: fix use-after-free 



Lockless access to __ptr_ring_full is only legal if ring is
never resized, otherwise it might cause use-after free errors.
Simply drop the lockless test, we'll drop the packet
a bit later when produce fails.

Fixes: 362899b8 ("macvtap: switch to use skb array")
Signed-off-by: default avatarMichael S. Tsirkin <mst@redhat.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent a259df36

drivers/net/tap.c

+0 −3
Original line number Diff line number Diff line
@@ -330,9 +330,6 @@ rx_handler_result_t tap_handle_frame(struct sk_buff **pskb) 
	if (!q)

		return RX_HANDLER_PASS;



	if (__ptr_ring_full(&q->ring))

		goto drop;



	skb_push(skb, ETH_HLEN);



	/* Apply the forward feature mask so that we perform segmentation