summaryrefslogtreecommitdiff
path: root/net/hsr
diff options
context:
space:
mode:
authorYueHaibing <yuehaibing@huawei.com>2022-11-25 15:57:24 +0800
committerJakub Kicinski <kuba@kernel.org>2022-11-28 18:09:00 -0800
commit7e177d32442b7ed08a9fa61b61724abc548cb248 (patch)
tree66c082d234a0016ae7e5713ed713d62b22e49d21 /net/hsr
parent3067bc61fcfe3081bf4807ce65560f499e895e77 (diff)
net: hsr: Fix potential use-after-free
The skb is delivered to netif_rx() which may free it, after calling this, dereferencing skb may trigger use-after-free. Fixes: f421436a591d ("net/hsr: Add support for the High-availability Seamless Redundancy protocol (HSRv0)") Signed-off-by: YueHaibing <yuehaibing@huawei.com> Link: https://lore.kernel.org/r/20221125075724.27912-1-yuehaibing@huawei.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Diffstat (limited to 'net/hsr')
-rw-r--r--net/hsr/hsr_forward.c5
1 files changed, 3 insertions, 2 deletions
diff --git a/net/hsr/hsr_forward.c b/net/hsr/hsr_forward.c
index a50429a62f74..56bb27d67a2e 100644
--- a/net/hsr/hsr_forward.c
+++ b/net/hsr/hsr_forward.c
@@ -351,17 +351,18 @@ static void hsr_deliver_master(struct sk_buff *skb, struct net_device *dev,
struct hsr_node *node_src)
{
bool was_multicast_frame;
- int res;
+ int res, recv_len;
was_multicast_frame = (skb->pkt_type == PACKET_MULTICAST);
hsr_addr_subst_source(node_src, skb);
skb_pull(skb, ETH_HLEN);
+ recv_len = skb->len;
res = netif_rx(skb);
if (res == NET_RX_DROP) {
dev->stats.rx_dropped++;
} else {
dev->stats.rx_packets++;
- dev->stats.rx_bytes += skb->len;
+ dev->stats.rx_bytes += recv_len;
if (was_multicast_frame)
dev->stats.multicast++;
}