aef5ceb9b1
When we free cb->skb after a dump, we do it after releasing the
lock. This means that a new dump could have started in the time
being and we'll end up freeing their skb instead of ours.
This patch saves the skb and module before we unlock so we free
the right memory.
Change-Id: I81f1eb1ef4951917b5db084bd7a4289222eab597
Fixes: 16b304f3404f ("netlink: Eliminate kmalloc in netlink dump operation.")
Reported-by: Baozeng Ding <sploving1@gmail.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Acked-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
CVE-2016-9806
Signed-off-by: Kevin F. Haggerty <haggertk@lineageos.org>
|
||
|---|---|---|
| .. | ||
| Makefile | ||
| af_netlink.c | ||
| genetlink.c | ||