patrick/zephyr
1
0
Fork 0
Code Issues Pull requests Actions 8 Packages Projects Releases Wiki Activity

net: Fix access to already unref'ed packet data

Browse source 
net_icmp4_input() may net_pkt_unref() a packet. The header mustn't be
accessed after this or the system may crash.

Signed-off-by: Oliver Hitz <oliver@net-track.ch>
This commit is contained in:
Oliver Hitz 2020-10-19 15:34:59 +02:00 committed by Jukka Rissanen
parent c13603ef87
commit a704af4a3e
1 changed files with 4 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
subsys/net/ip/ipv4.c
View file

@ -298,7 +298,10 @@ enum net_verdict net_ipv4_input(struct net_pkt *pkt)
switch (hdr->proto) {
case IPPROTO_ICMP:
verdict = net_icmpv4_input(pkt, hdr);
break;
if (verdict == NET_DROP) {
goto drop;
}
return verdict;
case IPPROTO_TCP:
proto_hdr.tcp = net_tcp_input(pkt, &tcp_access);
if (proto_hdr.tcp) {
@ -315,8 +318,6 @@ enum net_verdict net_ipv4_input(struct net_pkt *pkt)
if (verdict == NET_DROP) {
goto drop;
} else if (hdr->proto == IPPROTO_ICMP) {
return verdict;
}
ip.ipv4 = hdr;