ATM: mpc, fix use after free

Jiri Slaby · davem330 · commit 5518b29f225d · 2010-10-11T11:05:42.000-07:00
Stanse found that mpc_push frees skb and then it dereferences it. It
is a typo, new_skb should be dereferenced there.

Signed-off-by: Jiri Slaby &lt;jslaby@suse.cz&gt;
Cc: Eric Dumazet &lt;eric.dumazet@gmail.com&gt;
Acked-by: Eric Dumazet &lt;eric.dumazet@gmail.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
diff --git a/net/atm/mpc.c b/net/atm/mpc.c
@@ -778,7 +778,7 @@ static void mpc_push(struct atm_vcc *vcc, struct sk_buff *skb)
 	eg->packets_rcvd++;
 	mpc->eg_ops->put(eg);
 
-	memset(ATM_SKB(skb), 0, sizeof(struct atm_skb_data));
+	memset(ATM_SKB(new_skb), 0, sizeof(struct atm_skb_data));
 	netif_rx(new_skb);
 }
 

Original file line number	Diff line number	Diff line change
`@@ -778,7 +778,7 @@ static void mpc_push(struct atm_vcc vcc, struct sk_buff skb)`
`778`	`778`	`eg->packets_rcvd++;`
`779`	`779`	`mpc->eg_ops->put(eg);`
`780`	`780`
`781`		`- memset(ATM_SKB(skb), 0, sizeof(struct atm_skb_data));`
	`781`	`+ memset(ATM_SKB(new_skb), 0, sizeof(struct atm_skb_data));`
`782`	`782`	`netif_rx(new_skb);`
`783`	`783`	`}`
`784`	`784`