Re: [PATCH] net/rxrpc: Fix a use after free in rxrpc_input_packet

Lv Yunlong wrote: > In the case RXRPC_PACKET_TYPE_DATA of rxrpc_input_packet, if > skb_unshare(skb,..) failed, it will free the skb and return NULL. > But if skb_unshare() return NULL, the freed skb will be used by > rxrpc_eaten_skb(skb,..). That's not precisely the case: void rxrpc_eat

[PATCH] net/rxrpc: Fix a use after free in rxrpc_input_packet

In the case RXRPC_PACKET_TYPE_DATA of rxrpc_input_packet, if skb_unshare(skb,..) failed, it will free the skb and return NULL. But if skb_unshare() return NULL, the freed skb will be used by rxrpc_eaten_skb(skb,..). I see that rxrpc_eaten_skb() is used to drop a ref of skb. As the skb is already f