[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-Id: <20240708205826.5176-1-olek2@wp.pl>
Date: Mon, 8 Jul 2024 22:58:26 +0200
From: Aleksander Jan Bajkowski <olek2@...pl>
To: davem@...emloft.net,
edumazet@...gle.com,
kuba@...nel.org,
pabeni@...hat.com,
jacob.e.keller@...el.com,
shannon.nelson@....com,
horms@...nel.org,
sd@...asysnail.net,
olek2@...pl,
u.kleine-koenig@...gutronix.de,
ralf@...ux-mips.org,
ralph.hempel@...tiq.com,
john@...ozen.org,
netdev@...r.kernel.org,
linux-kernel@...r.kernel.org
Cc: Joe Perches <joe@...ches.com>,
Andrew Lunn <andrew@...n.ch>
Subject: [PATCH net v3] net: ethernet: lantiq_etop: fix double free in detach
The number of the currently released descriptor is never incremented
which results in the same skb being released multiple times.
Fixes: 504d4721ee8e ("MIPS: Lantiq: Add ethernet driver")
Reported-by: Joe Perches <joe@...ches.com>
Closes: https://lore.kernel.org/all/fc1bf93d92bb5b2f99c6c62745507cc22f3a7b2d.camel@perches.com/
Signed-off-by: Aleksander Jan Bajkowski <olek2@...pl>
Reviewed-by: Andrew Lunn <andrew@...n.ch>
---
drivers/net/ethernet/lantiq_etop.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/net/ethernet/lantiq_etop.c b/drivers/net/ethernet/lantiq_etop.c
index 5352fee62d2b..0b9982804370 100644
--- a/drivers/net/ethernet/lantiq_etop.c
+++ b/drivers/net/ethernet/lantiq_etop.c
@@ -217,9 +217,9 @@ ltq_etop_free_channel(struct net_device *dev, struct ltq_etop_chan *ch)
if (ch->dma.irq)
free_irq(ch->dma.irq, priv);
if (IS_RX(ch->idx)) {
- int desc;
+ struct ltq_dma_channel *dma = &ch->dma;
- for (desc = 0; desc < LTQ_DESC_NUM; desc++)
+ for (dma->desc = 0; dma->desc < LTQ_DESC_NUM; dma->desc++)
dev_kfree_skb_any(ch->skb[ch->dma.desc]);
}
}
--
2.39.2
Powered by blists - more mailing lists