diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2018-06-01 10:59:25 +0300 |
|---|---|---|
| committer | Herbert Xu <herbert@gondor.apana.org.au> | 2018-06-15 23:06:45 +0800 |
| commit | f70b359b3830b7a5b72c78136edc740839b67acd (patch) | |
| tree | ff85623d9bd6aa86ec7247d69350754ea988800b /drivers/crypto/chelsio/chtls/chtls_io.c | |
| parent | b268b3506d9910ca8238e92cb1dc51340574b2f2 (diff) | |
| download | linux-f70b359b3830b7a5b72c78136edc740839b67acd.tar.bz2 | |
crypto: chtls - use after free in chtls_pt_recvmsg()
We call chtls_free_skb() but then we dereference it on the next lines.
Also "skb" can't be NULL, we just dereferenced it on the line before.
I have moved the free down a couple lines to fix this issue.
Fixes: 17a7d24aa89d ("crypto: chtls - generic handling of data and hdr")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Diffstat (limited to 'drivers/crypto/chelsio/chtls/chtls_io.c')
| -rw-r--r-- | drivers/crypto/chelsio/chtls/chtls_io.c | 5 |
1 files changed, 2 insertions, 3 deletions
diff --git a/drivers/crypto/chelsio/chtls/chtls_io.c b/drivers/crypto/chelsio/chtls/chtls_io.c index 51fc6821cbbf..708e232e3cdf 100644 --- a/drivers/crypto/chelsio/chtls/chtls_io.c +++ b/drivers/crypto/chelsio/chtls/chtls_io.c @@ -1548,15 +1548,14 @@ skip_copy: tp->urg_data = 0; if ((avail + offset) >= skb->len) { - if (likely(skb)) - chtls_free_skb(sk, skb); - buffers_freed++; if (ULP_SKB_CB(skb)->flags & ULPCB_FLAG_TLS_HDR) { tp->copied_seq += skb->len; hws->rcvpld = skb->hdr_len; } else { tp->copied_seq += hws->rcvpld; } + chtls_free_skb(sk, skb); + buffers_freed++; hws->copied_seq = 0; if (copied >= target && !skb_peek(&sk->sk_receive_queue)) |