mirror of
https://github.com/torvalds/linux.git
synced 2026-09-14 16:10:02 +02:00
ab71cf79e2
garp_pdu_parse_attr() keeps a pointer into the skb linear area across pskb_may_pull(skb, ga->len), and garp_pdu_parse_msg() dereferences gm on every loop iteration even though the nested parse may pull again. pskb_may_pull() can reallocate the skb head, which would leave those pointers stale. This is not reachable today: GARP PDUs arrive via the 802.2 LLC SAP path, where llc_fixup_skb() already pulls and trims the whole payload into the linear area, so the inner pulls never reallocate. Reload ga after the pull and snapshot gm->attrtype into a local anyway, to harden the parser and match the skb_header_pointer() discipline used by mrp.c. No functional change. Signed-off-by: David Carlier <devnexen@gmail.com> Link: https://patch.msgid.link/20260604141925.237746-1-devnexen@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> |
||
|---|---|---|
| .. | ||
| fc.c | ||
| fddi.c | ||
| garp.c | ||
| Kconfig | ||
| Makefile | ||
| mrp.c | ||
| psnap.c | ||
| stp.c | ||