mirror-linux/net/hsr
Dan Carpenter 6086258bd5 hsr: Prevent use after free in prp_create_tagged_frame()
[ Upstream commit 876f8ab523 ]

The prp_fill_rct() function can fail.  In that situation, it frees the
skb and returns NULL.  Meanwhile on the success path, it returns the
original skb.  So it's straight forward to fix bug by using the returned
value.

Fixes: 451d8123f8 ("net: prp: add packet handling support")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Acked-by: Paolo Abeni <pabeni@redhat.com>
Link: https://lore.kernel.org/r/57af1f28-7f57-4a96-bcd3-b7a0f2340845@moroto.mountain
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-11-20 11:52:15 +01:00
..
Kconfig
Makefile
hsr_debugfs.c Revert "net: hsr: use hlist_head instead of list_head for mac addresses" 2022-12-31 13:32:21 +01:00
hsr_device.c hsr: Synchronize sending frames to have always incremented outgoing seq nr. 2022-12-31 13:32:22 +01:00
hsr_device.h
hsr_forward.c hsr: Prevent use after free in prp_create_tagged_frame() 2023-11-20 11:52:15 +01:00
hsr_forward.h
hsr_framereg.c net: hsr: Properly parse HSRv1 supervisor frames. 2023-10-06 14:56:39 +02:00
hsr_framereg.h hsr: Synchronize sequence number updates. 2022-12-31 13:32:22 +01:00
hsr_main.c
hsr_main.h net: hsr: Add __packed to struct hsr_sup_tlv. 2023-10-06 14:56:57 +02:00
hsr_netlink.c Revert "net: hsr: use hlist_head instead of list_head for mac addresses" 2022-12-31 13:32:21 +01:00
hsr_netlink.h
hsr_slave.c
hsr_slave.h