netdev - [PATCH] af_packet: tpacket_destruct_skb, deref skb after BUG

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20111009171919.10922hrx8qjm2f7b@webmail.your-server.de>
Date:	Sun, 09 Oct 2011 17:19:19 +0200
From:	danborkmann@...earbox.net
To:	"David S. Miller" <davem@...emloft.net>, netdev@...r.kernel.org
Subject: [PATCH] af_packet: tpacket_destruct_skb, deref skb after BUG_ON
 assertion

This tiny patch derefs the skb only after BUG_ON(skb==NULL) was evaluated
and not before. Patched against latest Linus tree.

Thanks,
Daniel

Signed-off-by: Daniel Borkmann <danborkmann@...earbox.net>

diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index fabb4fa..d9d833b 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -1167,11 +1167,12 @@ ring_is_full:

  static void tpacket_destruct_skb(struct sk_buff *skb)
  {
-	struct packet_sock *po = pkt_sk(skb->sk);
+	struct packet_sock *po;
  	void *ph;

  	BUG_ON(skb == NULL);

+	po = pkt_sk(skb->sk);
  	if (likely(po->tx_ring.pg_vec)) {
  		ph = skb_shinfo(skb)->destructor_arg;
  		BUG_ON(__packet_get_status(po, ph) != TP_STATUS_SENDING);

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html