OpenCloudOS-Kernel/drivers/net/ethernet/qualcomm
Lv Yunlong 6d72e7c767 net:emac/emac-mac: Fix a use after free in emac_mac_tx_buf_send
In emac_mac_tx_buf_send, it calls emac_tx_fill_tpd(..,skb,..).
If some error happens in emac_tx_fill_tpd(), the skb will be freed via
dev_kfree_skb(skb) in error branch of emac_tx_fill_tpd().
But the freed skb is still used via skb->len by netdev_sent_queue(,skb->len).

As i observed that emac_tx_fill_tpd() haven't modified the value of skb->len,
thus my patch assigns skb->len to 'len' before the possible free and
use 'len' instead of skb->len later.

Fixes: b9b17debc6 ("net: emac: emac gigabit ethernet controller driver")
Signed-off-by: Lv Yunlong <lyl2019@mail.ustc.edu.cn>
Signed-off-by: David S. Miller <davem@davemloft.net>
2021-04-26 13:07:30 -07:00
..
emac net:emac/emac-mac: Fix a use after free in emac_mac_tx_buf_send 2021-04-26 13:07:30 -07:00
rmnet net: qualcomm: rmnet: don't use C bit-fields in rmnet checksum header 2021-03-15 20:41:58 -07:00
Kconfig treewide: replace '---help---' in Kconfig files with 'help' 2020-06-14 01:57:21 +09:00
Makefile License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
qca_7k.c net: qca_spi: Introduce write register verification 2018-09-24 12:26:06 -07:00
qca_7k.h net: qca_spi: Introduce write register verification 2018-09-24 12:26:06 -07:00
qca_7k_common.c net: qualcomm: make qca_7k_common a separate kernel module 2017-05-30 13:57:30 -04:00
qca_7k_common.h net: qualcomm: add QCA7000 UART driver 2017-05-30 13:57:32 -04:00
qca_debug.c qca: no need to check return value of debugfs_create functions 2019-08-10 15:25:48 -07:00
qca_debug.h
qca_spi.c of: net: pass the dst buffer to of_get_mac_address() 2021-04-13 14:35:02 -07:00
qca_spi.h net: qca_spi: Move reset_count to struct qcaspi 2019-11-20 12:42:23 -08:00
qca_uart.c of: net: pass the dst buffer to of_get_mac_address() 2021-04-13 14:35:02 -07:00