OSDN Git Service
(root)
/
tomoyo
/
tomoyo-test1.git
/ commitdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
| commitdiff |
tree
raw
|
patch
| inline |
side by side
(parent:
cb37617
)
net: hisilicon: Fix potential use-after-free in hix5hd2_rx()
author
Liu Jian
<liujian56@huawei.com>
Sat, 3 Dec 2022 09:42:40 +0000
(17:42 +0800)
committer
Paolo Abeni
<pabeni@redhat.com>
Tue, 6 Dec 2022 11:53:31 +0000
(12:53 +0100)
The skb is delivered to napi_gro_receive() which may free it, after
calling this, dereferencing skb may trigger use-after-free.
Fixes:
57c5bc9ad7d7
("net: hisilicon: add hix5hd2 mac driver")
Signed-off-by: Liu Jian <liujian56@huawei.com>
Link:
https://lore.kernel.org/r/20221203094240.1240211-2-liujian56@huawei.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
drivers/net/ethernet/hisilicon/hix5hd2_gmac.c
patch
|
blob
|
history
diff --git
a/drivers/net/ethernet/hisilicon/hix5hd2_gmac.c
b/drivers/net/ethernet/hisilicon/hix5hd2_gmac.c
index
ffcf797
..
f867e95
100644
(file)
--- a/
drivers/net/ethernet/hisilicon/hix5hd2_gmac.c
+++ b/
drivers/net/ethernet/hisilicon/hix5hd2_gmac.c
@@
-550,7
+550,7
@@
static int hix5hd2_rx(struct net_device *dev, int limit)
skb->protocol = eth_type_trans(skb, dev);
napi_gro_receive(&priv->napi, skb);
dev->stats.rx_packets++;
- dev->stats.rx_bytes +=
skb->
len;
+ dev->stats.rx_bytes += len;
next:
pos = dma_ring_incr(pos, RX_DESC_NUM);
}