xiaomi-sm8450/android_kernel_xiaomi_sm8450
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

net: hsr: Fix potential use-after-free

Browse Source 
[ Upstream commit 7e177d32442b7ed08a9fa61b61724abc548cb248 ]

The skb is delivered to netif_rx() which may free it, after calling this,
dereferencing skb may trigger use-after-free.

Fixes: f421436a59 ("net/hsr: Add support for the High-availability Seamless Redundancy protocol (HSRv0)")
Signed-off-by: YueHaibing <yuehaibing@huawei.com>
Link: https://lore.kernel.org/r/20221125075724.27912-1-yuehaibing@huawei.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
YueHaibing
2022-11-25 15:57:24 +08:00
committed by Greg Kroah-Hartman
parent a1ba595e35
commit 7ca81a161e
1 changed files with 3 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
net/hsr/hsr_forward.c
View File

@@ -303,17 +303,18 @@ static void hsr_deliver_master(struct sk_buff *skb, struct net_device *dev,
struct hsr_node *node_src) struct hsr_node *node_src)
{ {
bool was_multicast_frame; bool was_multicast_frame;
int res; int res, recv_len;
was_multicast_frame = (skb->pkt_type == PACKET_MULTICAST); was_multicast_frame = (skb->pkt_type == PACKET_MULTICAST);
hsr_addr_subst_source(node_src, skb); hsr_addr_subst_source(node_src, skb);
skb_pull(skb, ETH_HLEN); skb_pull(skb, ETH_HLEN);
recv_len = skb->len;
res = netif_rx(skb); res = netif_rx(skb);
if (res == NET_RX_DROP) { if (res == NET_RX_DROP) {
dev->stats.rx_dropped++; dev->stats.rx_dropped++;
} else { } else {
dev->stats.rx_packets++; dev->stats.rx_packets++;
dev->stats.rx_bytes += skb->len; dev->stats.rx_bytes += recv_len;
if (was_multicast_frame) if (was_multicast_frame)
dev->stats.multicast++; dev->stats.multicast++;
} }