Commit 188ccb55 authored by Patrick McHardy's avatar Patrick McHardy Committed by David S. Miller
Browse files

[NETLINK]: Fix use after free in netlink_recvmsg 



When the user passes in MSG_TRUNC the skb is used after getting freed.

Signed-off-by: default avatarPatrick McHardy <kaber@trash.net>
Signed-off-by: default avatarDavid Howells <dhowells@redhat.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 3f660d66

net/netlink/af_netlink.c

+2 −4
Original line number Diff line number Diff line
@@ -1246,16 +1246,14 @@ static int netlink_recvmsg(struct kiocb *kiocb, struct socket *sock, 
		siocb->scm = &scm;

	}

	siocb->scm->creds = *NETLINK_CREDS(skb);

	if (flags & MSG_TRUNC)

		copied = skb->len;

	skb_free_datagram(sk, skb);



	if (nlk->cb && atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf / 2)

		netlink_dump(sk);



	scm_recv(sock, msg, siocb->scm, flags);



	if (flags & MSG_TRUNC)

		copied = skb->len;



out:

	netlink_rcv_wake(sk);

	return err ? : copied;