From: gfree.w...@vip.163.com
Date: Tue, 9 May 2017 18:27:33 +0800
> From: Gao Feng
>
> The current codes only deal with the case that the skb is dropped, it
> may meet one use-after-free issue when NF_HOOK returns 0 that means
> the skb is stolen by one netfilter rule or hook.
>
> When one net
At 2017-05-10 02:37:36, "David Miller" wrote:
>From: gfree.w...@vip.163.com
>Date: Tue, 9 May 2017 18:27:33 +0800
>
>> @@ -989,6 +989,7 @@ static u32 vrf_fib_table(const struct net_device *dev)
>>
>> static int vrf_rcv_finish(struct net *net, struct sock *sk, struct sk_buff
>> *skb)
>> {
>>
From: gfree.w...@vip.163.com
Date: Tue, 9 May 2017 18:27:33 +0800
> @@ -989,6 +989,7 @@ static u32 vrf_fib_table(const struct net_device *dev)
>
> static int vrf_rcv_finish(struct net *net, struct sock *sk, struct sk_buff
> *skb)
> {
> + kfree_skb(skb);
> return 0;
> }
>
> @@ -9
David Ahern wrote:
> On 5/9/17 3:27 AM, gfree.w...@vip.163.com wrote:
> > diff --git a/drivers/net/vrf.c b/drivers/net/vrf.c
> > index ceda586..db88249 100644
> > --- a/drivers/net/vrf.c
> > +++ b/drivers/net/vrf.c
> > @@ -989,6 +989,7 @@ static u32 vrf_fib_table(const struct net_device *dev)
> >
On 5/9/17 3:27 AM, gfree.w...@vip.163.com wrote:
> diff --git a/drivers/net/vrf.c b/drivers/net/vrf.c
> index ceda586..db88249 100644
> --- a/drivers/net/vrf.c
> +++ b/drivers/net/vrf.c
> @@ -989,6 +989,7 @@ static u32 vrf_fib_table(const struct net_device *dev)
>
> static int vrf_rcv_finish(str
From: Gao Feng
The current codes only deal with the case that the skb is dropped, it
may meet one use-after-free issue when NF_HOOK returns 0 that means
the skb is stolen by one netfilter rule or hook.
When one netfilter rule or hook stoles the skb and return NF_STOLEN,
it means the skb is taken
