lkml.org 
[lkml]   [2022]   [Mar]   [14]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.16 090/121] staging: gdm724x: fix use after free in gdm_lte_rx()
    Date
    From: Dan Carpenter <dan.carpenter@oracle.com>

    commit fc7f750dc9d102c1ed7bbe4591f991e770c99033 upstream.

    The netif_rx_ni() function frees the skb so we can't dereference it to
    save the skb->len.

    Fixes: 61e121047645 ("staging: gdm7240: adding LTE USB driver")
    Cc: stable <stable@vger.kernel.org>
    Reported-by: kernel test robot <lkp@intel.com>
    Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
    Link: https://lore.kernel.org/r/20220228074331.GA13685@kili
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    drivers/staging/gdm724x/gdm_lte.c | 5 +++--
    1 file changed, 3 insertions(+), 2 deletions(-)

    diff --git a/drivers/staging/gdm724x/gdm_lte.c b/drivers/staging/gdm724x/gdm_lte.c
    index 493ed4821515..0d8d8fed283d 100644
    --- a/drivers/staging/gdm724x/gdm_lte.c
    +++ b/drivers/staging/gdm724x/gdm_lte.c
    @@ -76,14 +76,15 @@ static void tx_complete(void *arg)

    static int gdm_lte_rx(struct sk_buff *skb, struct nic *nic, int nic_type)
    {
    - int ret;
    + int ret, len;

    + len = skb->len + ETH_HLEN;
    ret = netif_rx_ni(skb);
    if (ret == NET_RX_DROP) {
    nic->stats.rx_dropped++;
    } else {
    nic->stats.rx_packets++;
    - nic->stats.rx_bytes += skb->len + ETH_HLEN;
    + nic->stats.rx_bytes += len;
    }

    return 0;
    --
    2.35.1


    \
     
     \ /
      Last update: 2022-03-14 13:38    [W:4.573 / U:0.012 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site