Subject: Re: [PATCH 1/5] [NETLINK]: Fix use after free in netlink_recvmsg

From: Marcel Holtmann <[email-masked]>
Date: Thu, 03 May 2007 14:27:16 +0200

Hi Dave,

> > When the user passes in MSG_TRUNC the skb is used after getting freed.
> > 
> > Signed-off-by: Patrick McHardy <[email-masked]>
> > Signed-off-by: David Howells <[email-masked]>
> 
> Ugh, good catch, applied :-)

it seems this could be easily exploited and is at least a local DoS. It
should be a candidate for the -stable kernel.

Regards

Marcel