staging: gdm724x: fix use after free in gdm_lte_rx()

PATCH New Dan Carpenter 1 participant 1 message Feb 28, 2022

Subsystems (2)

Staging Kernel janitors

lore

Share & tools

lore

Dan Carpenter

author

2022-02-28 07:43 UTC #0 lore raw

PATCH 1/1 staging: gdm724x: fix use after free in gdm_lte_rx()

The netif_rx_ni() function frees the skb so we can't dereference it to save the skb->len.

Fixes 61e121047645 ("staging: gdm7240: adding LTE USB driver")

Reported-by kernel test robot <[email protected]>

Signed-off-by Dan Carpenter <[email protected]>

---
 drivers/staging/gdm724x/gdm_lte.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

drivers/staging/gdm724x/gdm_lte.c +3 -2

index 493ed4821515..0d8d8fed283d 100644
@@ -76,14 +76,15 @@ static void tx_complete(void *arg)
 
 static int gdm_lte_rx(struct sk_buff *skb, struct nic *nic, int nic_type)
 {
-	int ret;
+	int ret, len;
 
+	len = skb->len + ETH_HLEN;
 	ret = netif_rx_ni(skb);
 	if (ret == NET_RX_DROP) {
 		nic->stats.rx_dropped++;
 	} else {
 		nic->stats.rx_packets++;
-		nic->stats.rx_bytes += skb->len + ETH_HLEN;
+		nic->stats.rx_bytes += len;
 	}
 
 	return 0;

Signature · 1 line

2.20.1