From: Patrick McHardy <kaber@trash.net>
Date: Thu, 3 May 2007 10:27:01 +0000 (-0700)
Subject: [NETLINK]: Fix use after free in netlink_recvmsg
X-Git-Tag: v2.6.22-rc1~1036^2~41
X-Git-Url: http://ftp.safe.ca/?a=commitdiff_plain;h=188ccb5583b8f501e1d0f5ba4f056afa141694e7;p=safe%2Fjmp%2Flinux-2.6

[NETLINK]: Fix use after free in netlink_recvmsg

When the user passes in MSG_TRUNC the skb is used after getting freed.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
---

diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index 7fc6b4d..ac1cead 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -1246,16 +1246,14 @@ static int netlink_recvmsg(struct kiocb *kiocb, struct socket *sock,
 		siocb->scm = &scm;
 	}
 	siocb->scm->creds = *NETLINK_CREDS(skb);
+	if (flags & MSG_TRUNC)
+		copied = skb->len;
 	skb_free_datagram(sk, skb);
 
 	if (nlk->cb && atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf / 2)
 		netlink_dump(sk);
 
 	scm_recv(sock, msg, siocb->scm, flags);
-
-	if (flags & MSG_TRUNC)
-		copied = skb->len;
-
 out:
 	netlink_rcv_wake(sk);
 	return err ? : copied;