diff options
| author | Eric Dumazet <[email protected]> | 2025-06-20 14:28:44 +0000 |
|---|---|---|
| committer | David S. Miller <[email protected]> | 2025-06-22 18:31:14 +0000 |
| commit | b993ea46b3b601915ceaaf3c802adf11e7d6bac6 (patch) | |
| tree | 185e77ce5547f20aa42fee8c5fbeb76536c93c70 /net/unix/af_unix.c | |
| parent | Fix typo in marvell octeontx2 documentation (diff) | |
| download | kernel-b993ea46b3b601915ceaaf3c802adf11e7d6bac6.tar.gz kernel-b993ea46b3b601915ceaaf3c802adf11e7d6bac6.zip | |
atm: clip: prevent NULL deref in clip_push()
Blamed commit missed that vcc_destroy_socket() calls
clip_push() with a NULL skb.
If clip_devs is NULL, clip_push() then crashes when reading
skb->truesize.
Fixes: 93a2014afbac ("atm: fix a UAF in lec_arp_clear_vccs()")
Reported-by: [email protected]
Closes: https://lore.kernel.org/netdev/[email protected]/T/#u
Signed-off-by: Eric Dumazet <[email protected]>
Cc: Cong Wang <[email protected]>
Cc: Gengming Liu <[email protected]>
Reviewed-by: Simon Horman <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
Diffstat (limited to 'net/unix/af_unix.c')
0 files changed, 0 insertions, 0 deletions