aboutsummaryrefslogtreecommitdiffstats
path: root/include
diff options
context:
space:
mode:
authorRoss Lagerwall <ross.lagerwall@citrix.com>2019-01-17 15:34:38 +0000
committerDavid S. Miller <davem@davemloft.net>2019-01-18 14:05:14 -0800
commit6c57f0458022298e4da1729c67bd33ce41c14e7a (patch)
treec56bc8518423b39cabbda138327a313262ea1e9e /include
parentnet: phy: mdio_bus: add missing device_del() in mdiobus_register() error handling (diff)
downloadlinux-dev-6c57f0458022298e4da1729c67bd33ce41c14e7a.tar.xz
linux-dev-6c57f0458022298e4da1729c67bd33ce41c14e7a.zip
net: Fix usage of pskb_trim_rcsum
In certain cases, pskb_trim_rcsum() may change skb pointers. Reinitialize header pointers afterwards to avoid potential use-after-frees. Add a note in the documentation of pskb_trim_rcsum(). Found by KASAN. Signed-off-by: Ross Lagerwall <ross.lagerwall@citrix.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'include')
-rw-r--r--include/linux/skbuff.h1
1 files changed, 1 insertions, 0 deletions
diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index 93f56fddd92a..95d25b010a25 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -3218,6 +3218,7 @@ int pskb_trim_rcsum_slow(struct sk_buff *skb, unsigned int len);
*
* This is exactly the same as pskb_trim except that it ensures the
* checksum of received packets are still valid after the operation.
+ * It can change skb pointers.
*/
static inline int pskb_trim_rcsum(struct sk_buff *skb, unsigned int len)