From patchwork Fri Feb 25 05:39:37 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Matt Johnston X-Patchwork-Id: 12759679 X-Patchwork-Delegate: kuba@kernel.org Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id EC68BC433F5 for ; Fri, 25 Feb 2022 05:40:22 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236028AbiBYFkv (ORCPT ); Fri, 25 Feb 2022 00:40:51 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:54242 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S237594AbiBYFkc (ORCPT ); Fri, 25 Feb 2022 00:40:32 -0500 Received: from codeconstruct.com.au (pi.codeconstruct.com.au [203.29.241.158]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 160FA2C0305 for ; Thu, 24 Feb 2022 21:40:00 -0800 (PST) Received: by codeconstruct.com.au (Postfix, from userid 10001) id 4C25E202A2; Fri, 25 Feb 2022 13:39:59 +0800 (AWST) From: Matt Johnston To: netdev@vger.kernel.org Cc: "David S. Miller" , Jakub Kicinski , Jeremy Kerr , Dan Carpenter Subject: [PATCH net-next 2/3] mctp i2c: Fix potential use-after-free Date: Fri, 25 Feb 2022 13:39:37 +0800 Message-Id: <20220225053938.643605-3-matt@codeconstruct.com.au> X-Mailer: git-send-email 2.32.0 In-Reply-To: <20220225053938.643605-1-matt@codeconstruct.com.au> References: <20220225053938.643605-1-matt@codeconstruct.com.au> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org X-Patchwork-Delegate: kuba@kernel.org The skb is handed off to netif_rx() which may free it. Found by Smatch. Reported-By: Dan Carpenter Signed-off-by: Matt Johnston --- drivers/net/mctp/mctp-i2c.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/mctp/mctp-i2c.c b/drivers/net/mctp/mctp-i2c.c index 365c3dfd4034..470682c88d7e 100644 --- a/drivers/net/mctp/mctp-i2c.c +++ b/drivers/net/mctp/mctp-i2c.c @@ -338,7 +338,7 @@ static int mctp_i2c_recv(struct mctp_i2c_dev *midev) if (status == NET_RX_SUCCESS) { ndev->stats.rx_packets++; - ndev->stats.rx_bytes += skb->len; + ndev->stats.rx_bytes += recvlen; } else { ndev->stats.rx_dropped++; }