Re: [PATCH net-next 1/3] net: fix possible user-after-free in skb_ext_add()

2018-12-20 Thread Florian Westphal
Paolo Abeni wrote: > On cow we can free the old extension: we must avoid dereferencing > such extension after skb_ext_maybe_cow(). Since 'new' contents > are always equal to 'old' after the copy, we can fix the above > accessing the relevant data using 'new'. Yep, this is indeed possible when two

[PATCH net-next 1/3] net: fix possible user-after-free in skb_ext_add()

2018-12-20 Thread Paolo Abeni
On cow we can free the old extension: we must avoid dereferencing such extension after skb_ext_maybe_cow(). Since 'new' contents are always equal to 'old' after the copy, we can fix the above accessing the relevant data using 'new'. Fixes: df5042f4c5b9 ("sk_buff: add skb extension infrastructure")