mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/
synced 2026-11-10 20:48:12 +00:00
ab71cf79e2
garp_pdu_parse_attr() keeps a pointer into the skb linear area across pskb_may_pull(skb, ga->len), and garp_pdu_parse_msg() dereferences gm on every loop iteration even though the nested parse may pull again. pskb_may_pull() can reallocate the skb head, which would leave those pointers stale. This is not reachable today: GARP PDUs arrive via the 802.2 LLC SAP path, where llc_fixup_skb() already pulls and trims the whole payload into the linear area, so the inner pulls never reallocate. Reload ga after the pull and snapshot gm->attrtype into a local anyway, to harden the parser and match the skb_header_pointer() discipline used by mrp.c. No functional change. Signed-off-by: David Carlier <devnexen@gmail.com> Link: https://patch.msgid.link/20260604141925.237746-1-devnexen@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> |
History
|
|
|---|---|---|
| .. | ||
| fc.c | ||
| fddi.c | ||
| garp.c | ||
| Kconfig | ||
| Makefile | ||
| mrp.c | ||
| psnap.c | ||
| stp.c | ||