diff options
| author | Florian Westphal | 2022-02-28 06:22:22 +0100 |
|---|---|---|
| committer | Florian Westphal | 2022-03-01 11:50:35 +0100 |
| commit | c3873070247d9e3c7a6b0cf9bf9b45e8018427b1 (patch) | |
| tree | da192a08d0f995eaa2854d5033279ace339f2bcf /kernel/smpboot.h | |
| parent | 2e78855d311c401083df9776aa450d32d716e83e (diff) | |
netfilter: nf_queue: fix possible use-after-free
Eric Dumazet says:
The sock_hold() side seems suspect, because there is no guarantee
that sk_refcnt is not already 0.
On failure, we cannot queue the packet and need to indicate an
error. The packet will be dropped by the caller.
v2: split skb prefetch hunk into separate change
Fixes: 271b72c7fa82c ("udp: RCU handling for Unicast packets.")
Reported-by: Eric Dumazet <eric.dumazet@gmail.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
Diffstat (limited to 'kernel/smpboot.h')
0 files changed, 0 insertions, 0 deletions