Messages in this thread | | | Subject | Re: [PATCH] net:emac/emac-mac: Fix a use after free in emac_mac_tx_buf_send | From | patchwork-bot+netdevbpf@kernel ... | Date | Mon, 26 Apr 2021 20:40:09 +0000 |
| |
Hello:
This patch was applied to netdev/net-next.git (refs/heads/master):
On Mon, 26 Apr 2021 09:06:25 -0700 you wrote: > In emac_mac_tx_buf_send, it calls emac_tx_fill_tpd(..,skb,..). > If some error happens in emac_tx_fill_tpd(), the skb will be freed via > dev_kfree_skb(skb) in error branch of emac_tx_fill_tpd(). > But the freed skb is still used via skb->len by netdev_sent_queue(,skb->len). > > As i observed that emac_tx_fill_tpd() haven't modified the value of skb->len, > thus my patch assigns skb->len to 'len' before the possible free and > use 'len' instead of skb->len later. > > [...]
Here is the summary with links: - net:emac/emac-mac: Fix a use after free in emac_mac_tx_buf_send https://git.kernel.org/netdev/net-next/c/6d72e7c767ac
You are awesome, thank you! -- Deet-doot-dot, I am a bot. https://korg.docs.kernel.org/patchwork/pwbot.html
| |