summaryrefslogtreecommitdiffstats
path: root/drivers/net/mctp
diff options
context:
space:
mode:
authorMatt Johnston <matt@codeconstruct.com.au>2022-02-25 13:39:37 +0800
committerJakub Kicinski <kuba@kernel.org>2022-02-25 22:23:29 -0800
commit06bf1ce69d55729dc132d423d626398254fedc58 (patch)
tree98f4322027d4904f8cc4c1f262c3b572eb49ae75 /drivers/net/mctp
parentf62457df5cc46ea0729fface07ffa885e85ef404 (diff)
downloadlinux-06bf1ce69d55729dc132d423d626398254fedc58.tar.gz
linux-06bf1ce69d55729dc132d423d626398254fedc58.tar.bz2
linux-06bf1ce69d55729dc132d423d626398254fedc58.zip
mctp i2c: Fix potential use-after-free
The skb is handed off to netif_rx() which may free it. Found by Smatch. Reported-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Matt Johnston <matt@codeconstruct.com.au> Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Diffstat (limited to 'drivers/net/mctp')
-rw-r--r--drivers/net/mctp/mctp-i2c.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/net/mctp/mctp-i2c.c b/drivers/net/mctp/mctp-i2c.c
index 365c3dfd4034..470682c88d7e 100644
--- a/drivers/net/mctp/mctp-i2c.c
+++ b/drivers/net/mctp/mctp-i2c.c
@@ -338,7 +338,7 @@ static int mctp_i2c_recv(struct mctp_i2c_dev *midev)
if (status == NET_RX_SUCCESS) {
ndev->stats.rx_packets++;
- ndev->stats.rx_bytes += skb->len;
+ ndev->stats.rx_bytes += recvlen;
} else {
ndev->stats.rx_dropped++;
}