[EMAIL PROTECTED] wrote: > > http://bugzilla.kernel.org/show_bug.cgi?id=6186 > > Summary: net/ipv4/route.c: use after free in rt_fill_info > Kernel Version: 2.6.16-git > Status: NEW > Severity: normal > Owner: [EMAIL PROTECTED] > Submitter: [EMAIL PROTECTED] > > > When rt_fill_info passes an skb to ipmr_get_route, it doesn't handle the case > where ipmr_get_route frees the skb (it gets freed in ipmr_cache_unresolved). > > Instead, it bounces down to nlmsg_failure, where it calls skb_trim on the > deallocated skb. >
A coverity catch, I assume? - To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to [EMAIL PROTECTED] More majordomo info at http://vger.kernel.org/majordomo-info.html
