Commit 095c02da authored by Andreas Steinmetz's avatar Andreas Steinmetz Committed by David S. Miller
Browse files

macsec: fix use-after-free of skb during RX 



Fix use-after-free of skb when rx_handler returns RX_HANDLER_PASS.

Signed-off-by: default avatarAndreas Steinmetz <ast@domdv.de>
Acked-by: default avatarWillem de Bruijn <willemb@google.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent e835ada0

drivers/net/macsec.c

+2 −3
Original line number Diff line number Diff line
@@ -1099,10 +1099,9 @@ static rx_handler_result_t macsec_handle_frame(struct sk_buff **pskb) 
	}



	skb = skb_unshare(skb, GFP_ATOMIC);

	if (!skb) {

		*pskb = NULL;

	*pskb = skb;

	if (!skb)

		return RX_HANDLER_CONSUMED;

	}



	pulled_sci = pskb_may_pull(skb, macsec_extra_len(true));

	if (!pulled_sci) {