diff options
| author | YueHaibing <yuehaibing@huawei.com> | 2022-11-25 15:57:24 +0800 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2022-12-08 11:16:32 +0100 |
| commit | 4b351609af4fdbc23f79ab2b12748f4403ea9af4 (patch) | |
| tree | 9e60523c13e365cf9080db76e8d8ae14f140c588 /net | |
| parent | d0c5cbbbeaa041393e5a970d0a0c4e4d6a1aae11 (diff) | |
| download | linux-stable-4b351609af4fdbc23f79ab2b12748f4403ea9af4.tar.gz linux-stable-4b351609af4fdbc23f79ab2b12748f4403ea9af4.tar.bz2 linux-stable-4b351609af4fdbc23f79ab2b12748f4403ea9af4.zip | |
net: hsr: Fix potential use-after-free
[ Upstream commit 7e177d32442b7ed08a9fa61b61724abc548cb248 ]
The skb is delivered to netif_rx() which may free it, after calling this,
dereferencing skb may trigger use-after-free.
Fixes: f421436a591d ("net/hsr: Add support for the High-availability Seamless Redundancy protocol (HSRv0)")
Signed-off-by: YueHaibing <yuehaibing@huawei.com>
Link: https://lore.kernel.org/r/20221125075724.27912-1-yuehaibing@huawei.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'net')
| -rw-r--r-- | net/hsr/hsr_forward.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/net/hsr/hsr_forward.c b/net/hsr/hsr_forward.c index 04b5450c5a55..adfb49760678 100644 --- a/net/hsr/hsr_forward.c +++ b/net/hsr/hsr_forward.c @@ -207,17 +207,18 @@ static void hsr_deliver_master(struct sk_buff *skb, struct net_device *dev, struct hsr_node *node_src) { bool was_multicast_frame; - int res; + int res, recv_len; was_multicast_frame = (skb->pkt_type == PACKET_MULTICAST); hsr_addr_subst_source(node_src, skb); skb_pull(skb, ETH_HLEN); + recv_len = skb->len; res = netif_rx(skb); if (res == NET_RX_DROP) { dev->stats.rx_dropped++; } else { dev->stats.rx_packets++; - dev->stats.rx_bytes += skb->len; + dev->stats.rx_bytes += recv_len; if (was_multicast_frame) dev->stats.multicast++; } |