| Message ID | 20220221105440.GA10045@kili (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | b6553c71813f57b1bfa775af120169c549f7f090 |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | [v2,net-next] net: dm9051: Fix use after free in dm9051_loop_tx() | expand |
Hello: This patch was applied to netdev/net-next.git (master) by Jakub Kicinski <kuba@kernel.org>: On Mon, 21 Feb 2022 13:54:40 +0300 you wrote: > This code dereferences "skb" after calling dev_kfree_skb(). > > Fixes: 2dc95a4d30ed ("net: Add dm9051 driver") > Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> > --- > v2: Only record successful transfers > > [...] Here is the summary with links: - [v2,net-next] net: dm9051: Fix use after free in dm9051_loop_tx() https://git.kernel.org/netdev/net-next/c/b6553c71813f You are awesome, thank you!
diff --git a/drivers/net/ethernet/davicom/dm9051.c b/drivers/net/ethernet/davicom/dm9051.c index a63d17e669a0..20cdca06d267 100644 --- a/drivers/net/ethernet/davicom/dm9051.c +++ b/drivers/net/ethernet/davicom/dm9051.c @@ -845,17 +845,19 @@ static int dm9051_loop_tx(struct board_info *db) while (!skb_queue_empty(&db->txq)) { struct sk_buff *skb; + unsigned int len; skb = skb_dequeue(&db->txq); if (skb) { ntx++; ret = dm9051_single_tx(db, skb->data, skb->len); + len = skb->len; dev_kfree_skb(skb); if (ret < 0) { db->bc.tx_err_counter++; return 0; } - ndev->stats.tx_bytes += skb->len; + ndev->stats.tx_bytes += len; ndev->stats.tx_packets++; }
This code dereferences "skb" after calling dev_kfree_skb(). Fixes: 2dc95a4d30ed ("net: Add dm9051 driver") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> --- v2: Only record successful transfers drivers/net/ethernet/davicom/dm9051.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)