On Mon, Oct 14, 2024 at 5:38 PM Ignat Korchagin <[email protected]> wrote: > > After sock_init_data() the allocated sk object is attached to the provided > sock object. On error, packet_create() frees the sk object leaving the > dangling pointer in the sock object on return. Some other code may try > to use this pointer and cause use-after-free. > > Suggested-by: Eric Dumazet <[email protected]> > Signed-off-by: Ignat Korchagin <[email protected]> > ---
Reviewed-by: Eric Dumazet <[email protected]> Thanks.
