Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 21252f49 authored by Andreas Steinmetz's avatar Andreas Steinmetz Committed by Greg Kroah-Hartman
Browse files

macsec: fix use-after-free of skb during RX 



[ Upstream commit 095c02da80a41cf6d311c504d8955d6d1c2add10 ]

Fix use-after-free of skb when rx_handler returns RX_HANDLER_PASS.

Signed-off-by: default avatarAndreas Steinmetz <ast@domdv.de>
Acked-by: default avatarWillem de Bruijn <willemb@google.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent a8ba53da

drivers/net/macsec.c

+2 −3
Original line number Diff line number Diff line
@@ -1103,10 +1103,9 @@ static rx_handler_result_t macsec_handle_frame(struct sk_buff **pskb) 
	}



	skb = skb_unshare(skb, GFP_ATOMIC);

	if (!skb) {

		*pskb = NULL;

	*pskb = skb;

	if (!skb)

		return RX_HANDLER_CONSUMED;

	}



	pulled_sci = pskb_may_pull(skb, macsec_extra_len(true));

	if (!pulled_sci) {