patch "staging: gdm724x: fix use after free in gdm_lte_rx()" added to staging-linus

This is a note to let you know that I've just added the patch titled

staging: gdm724x: fix use after free in gdm_lte_rx()

to my staging git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging.git
in the staging-linus branch.

The patch will show up in the next release of the linux-next tree (usually sometime within the next 24 hours during the week.)

The patch will hopefully also be merged in Linus's tree for the next -rc kernel release.

If you have any questions about this process, please let me know.

From fc7f750dc9d102c1ed7bbe4591f991e770c99033 Mon Sep 17 00:00:00 2001
From: Dan Carpenter <[email protected]>
Date: Mon, 28 Feb 2022 10:43:31 +0300
Subject: staging: gdm724x: fix use after free in gdm_lte_rx()

The netif_rx_ni() function frees the skb so we can't dereference it to save the skb->len.

---
 drivers/staging/gdm724x/gdm_lte.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

index 493ed4821515..0d8d8fed283d 100644
@@ -76,14 +76,15 @@ static void tx_complete(void *arg)
 
 static int gdm_lte_rx(struct sk_buff *skb, struct nic *nic, int nic_type)
 {
-	int ret;
+	int ret, len;
 
+	len = skb->len + ETH_HLEN;
 	ret = netif_rx_ni(skb);
 	if (ret == NET_RX_DROP) {
 		nic->stats.rx_dropped++;
 	} else {
 		nic->stats.rx_packets++;
-		nic->stats.rx_bytes += skb->len + ETH_HLEN;
+		nic->stats.rx_bytes += len;
 	}
 
 	return 0;

2.35.1