Skip to content

Commit

Permalink
ravb: Fix potential use-after-free in ravb_rx_gbeth()
Browse files Browse the repository at this point in the history
The skb is delivered to napi_gro_receive() which may free it, after calling this,
dereferencing skb may trigger use-after-free.

Fixes: 1c59eb6 ("ravb: Fillup ravb_rx_gbeth() stub")
Signed-off-by: YueHaibing <[email protected]>
Reviewed-by: Geert Uytterhoeven <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Paolo Abeni <[email protected]>
  • Loading branch information
YueHaibing authored and Paolo Abeni committed Dec 6, 2022
1 parent 7b8232b commit 5a5a3e5
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion drivers/net/ethernet/renesas/ravb_main.c
Original file line number Diff line number Diff line change
Expand Up @@ -841,7 +841,7 @@ static bool ravb_rx_gbeth(struct net_device *ndev, int *quota, int q)
napi_gro_receive(&priv->napi[q],
priv->rx_1st_skb);
stats->rx_packets++;
stats->rx_bytes += priv->rx_1st_skb->len;
stats->rx_bytes += pkt_len;
break;
}
}
Expand Down

0 comments on commit 5a5a3e5

Please sign in to comment.