Subject: Re: [PATCH] packet: fix potential use after free

From: Daniel Borkmann <[email-masked]>
Date: Thu, 10 Apr 2014 10:19:21 +0200

On 04/10/2014 03:22 AM, Eric Dumazet wrote:
> From: Eric Dumazet <[email-masked]>
>
> As soon skb is queued into sk_receive_queue, it can be consumed,
> so its racy to access skb->len.
>
> Given that sk_data_ready() / sock_def_readable() don't really care, just
> use 0 instead of skb->len
>
> Signed-off-by: Eric Dumazet <[email-masked]>
> Cc: Xi Wang <[email-masked]>

Acked-by: Daniel Borkmann <[email-masked]>

Seems to be there since pre 2005 ...