[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <20221123063057.25952-1-yuehaibing@huawei.com>
Date: Wed, 23 Nov 2022 14:30:57 +0800
From: YueHaibing <yuehaibing@...wei.com>
To: <davem@...emloft.net>, <edumazet@...gle.com>, <kuba@...nel.org>,
<pabeni@...hat.com>, <arvid.brodin@...en.se>
CC: <netdev@...r.kernel.org>, <linux-kernel@...r.kernel.org>,
YueHaibing <yuehaibing@...wei.com>
Subject: [PATCH net] net: hsr: Fix potential use-after-free
The skb is delivered to netif_rx() which may free it, after calling this,
dereferencing skb may trigger use-after-free.
Fixes: f266a683a480 ("net/hsr: Better frame dispatch")
Signed-off-by: YueHaibing <yuehaibing@...wei.com>
---
net/hsr/hsr_forward.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/net/hsr/hsr_forward.c b/net/hsr/hsr_forward.c
index a50429a62f74..56bb27d67a2e 100644
--- a/net/hsr/hsr_forward.c
+++ b/net/hsr/hsr_forward.c
@@ -351,17 +351,18 @@ static void hsr_deliver_master(struct sk_buff *skb, struct net_device *dev,
struct hsr_node *node_src)
{
bool was_multicast_frame;
- int res;
+ int res, recv_len;
was_multicast_frame = (skb->pkt_type == PACKET_MULTICAST);
hsr_addr_subst_source(node_src, skb);
skb_pull(skb, ETH_HLEN);
+ recv_len = skb->len;
res = netif_rx(skb);
if (res == NET_RX_DROP) {
dev->stats.rx_dropped++;
} else {
dev->stats.rx_packets++;
- dev->stats.rx_bytes += skb->len;
+ dev->stats.rx_bytes += recv_len;
if (was_multicast_frame)
dev->stats.multicast++;
}
--
2.17.1
Powered by blists - more mailing lists