diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2022-02-21 13:54:40 +0300 |
|---|---|---|
| committer | Jakub Kicinski <kuba@kernel.org> | 2022-02-21 20:55:16 -0800 |
| commit | b6553c71813f57b1bfa775af120169c549f7f090 (patch) | |
| tree | b3553f49941d250844c944b17e456663cba9da6f | |
| parent | a0b92e0514bb3c5e57c33fd720724a629f67e042 (diff) | |
| download | linux-b6553c71813f57b1bfa775af120169c549f7f090.tar.bz2 | |
net: dm9051: Fix use after free in dm9051_loop_tx()
This code dereferences "skb" after calling dev_kfree_skb().
Fixes: 2dc95a4d30ed ("net: Add dm9051 driver")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Link: https://lore.kernel.org/r/20220221105440.GA10045@kili
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
| -rw-r--r-- | drivers/net/ethernet/davicom/dm9051.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/drivers/net/ethernet/davicom/dm9051.c b/drivers/net/ethernet/davicom/dm9051.c index 6a2bcfbfe891..b4b5c9c2a743 100644 --- a/drivers/net/ethernet/davicom/dm9051.c +++ b/drivers/net/ethernet/davicom/dm9051.c @@ -845,17 +845,19 @@ static int dm9051_loop_tx(struct board_info *db) while (!skb_queue_empty(&db->txq)) { struct sk_buff *skb; + unsigned int len; skb = skb_dequeue(&db->txq); if (skb) { ntx++; ret = dm9051_single_tx(db, skb->data, skb->len); + len = skb->len; dev_kfree_skb(skb); if (ret < 0) { db->bc.tx_err_counter++; return 0; } - ndev->stats.tx_bytes += skb->len; + ndev->stats.tx_bytes += len; ndev->stats.tx_packets++; } |