projects
/
firefly-linux-kernel-4.4.55.git
/ blobdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
|
commitdiff
|
tree
raw
| inline |
side by side
net: Fix use after free by removing length arg from sk_data_ready callbacks.
[firefly-linux-kernel-4.4.55.git]
/
net
/
key
/
af_key.c
diff --git
a/net/key/af_key.c
b/net/key/af_key.c
index e72589a8400dbf7e35a68468149bc7ce601b48be..f3c83073afc49f7aad98262cc5776b3edddc7f87 100644
(file)
--- a/
net/key/af_key.c
+++ b/
net/key/af_key.c
@@
-205,7
+205,7
@@
static int pfkey_broadcast_one(struct sk_buff *skb, struct sk_buff **skb2,
if (atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf) {
skb_set_owner_r(*skb2, sk);
skb_queue_tail(&sk->sk_receive_queue, *skb2);
- sk->sk_data_ready(sk
, (*skb2)->len
);
+ sk->sk_data_ready(sk);
*skb2 = NULL;
err = 0;
}