lk/linux-kernel-test
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Subject: [PATCH] appletalk: Fix skb leak when ipddp interface is not loaded

Browse Source 
And also do a better job of returning proper NET_{RX,XMIT}_ values.

Based on a patch and suggestions by Mark Smith.

This fixes CVE-2009-2903

Reported-by: Mark Smith <lk-netdev@lk-netdev.nosense.org>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Arnaldo Carvalho de Melo
2009-09-11 11:35:22 -07:00
committed by David S. Miller
parent 8ba69ba6a3
commit ffcfb8db54
3 changed files with 36 additions and 30 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
net/appletalk/aarp.c
View File

@ -599,7 +599,7 @@ int aarp_send_ddp(struct net_device *dev, struct sk_buff *skb,
/* Non ELAP we cannot do. */
if (dev->type != ARPHRD_ETHER)
return -1;
goto free_it;
skb->dev = dev;
skb->protocol = htons(ETH_P_ATALK);
@ -634,7 +634,7 @@ int aarp_send_ddp(struct net_device *dev, struct sk_buff *skb,
if (!a) {
/* Whoops slipped... good job it's an unreliable protocol 8) */
write_unlock_bh(&aarp_lock);
return -1;
goto free_it;
}
/* Set up the queue */
@ -663,15 +663,21 @@ out_unlock:
write_unlock_bh(&aarp_lock);
/* Tell the ddp layer we have taken over for this frame. */
return 0;
goto sent;
sendit:
if (skb->sk)
skb->priority = skb->sk->sk_priority;
dev_queue_xmit(skb);
if (dev_queue_xmit(skb))
goto drop;
sent:
return 1;
return NET_XMIT_SUCCESS;
free_it:
kfree_skb(skb);
drop:
return NET_XMIT_DROP;
}
EXPORT_SYMBOL(aarp_send_ddp);
/*
* An entry in the aarp unresolved queue has become resolved. Send