projects
/
deliverable
/
linux.git
/ blobdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
|
commitdiff
|
tree
raw
|
inline
| side by side
net: Fix use after free by removing length arg from sk_data_ready callbacks.
[deliverable/linux.git]
/
net
/
sctp
/
ulpqueue.c
diff --git
a/net/sctp/ulpqueue.c
b/net/sctp/ulpqueue.c
index 5dc94117e9d42d7e1eb24be6d8015c89feae7b6d..7144eb6a1b95ccad39f9376f723756e0b2c75a2c 100644
(file)
--- a/
net/sctp/ulpqueue.c
+++ b/
net/sctp/ulpqueue.c
@@
-259,7
+259,7
@@
int sctp_ulpq_tail_event(struct sctp_ulpq *ulpq, struct sctp_ulpevent *event)
sctp_ulpq_clear_pd(ulpq);
if (queue == &sk->sk_receive_queue)
sctp_ulpq_clear_pd(ulpq);
if (queue == &sk->sk_receive_queue)
- sk->sk_data_ready(sk
, 0
);
+ sk->sk_data_ready(sk);
return 1;
out_free:
return 1;
out_free:
@@
-1135,5
+1135,5
@@
void sctp_ulpq_abort_pd(struct sctp_ulpq *ulpq, gfp_t gfp)
/* If there is data waiting, send it up the socket now. */
if (sctp_ulpq_clear_pd(ulpq) || ev)
/* If there is data waiting, send it up the socket now. */
if (sctp_ulpq_clear_pd(ulpq) || ev)
- sk->sk_data_ready(sk
, 0
);
+ sk->sk_data_ready(sk);
}
}
This page took
0.044295 seconds
and
5
git commands to generate.