xiaomi-sm8450/android_kernel_xiaomi_sm8450
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

staging: rtl8192u: Fix use after free in ieee80211_rx()

Browse Source 
[ Upstream commit bcc5e2dcf09089b337b76fc1a589f6ff95ca19ac ]

We cannot dereference the "skb" pointer after calling
ieee80211_monitor_rx(), because it is a use after free.

Fixes: 8fc8598e61 ("Staging: Added Realtek rtl8192u driver to staging")
Signed-off-by: Dan Carpenter <error27@gmail.com>
Link: https://lore.kernel.org/r/Y33BArx3k/aw6yv/@kili
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Dan Carpenter
2022-11-23 09:43:14 +03:00
committed by Greg Kroah-Hartman
parent 46b3885c8c
commit daa8045a99
1 changed files with 3 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
drivers/staging/rtl8192u/ieee80211/ieee80211_rx.c
View File

@@ -954,9 +954,11 @@ int ieee80211_rx(struct ieee80211_device *ieee, struct sk_buff *skb,
#endif #endif
if (ieee->iw_mode == IW_MODE_MONITOR) { if (ieee->iw_mode == IW_MODE_MONITOR) {
unsigned int len = skb->len;
ieee80211_monitor_rx(ieee, skb, rx_stats); ieee80211_monitor_rx(ieee, skb, rx_stats);
stats->rx_packets++; stats->rx_packets++;
stats->rx_bytes += skb->len; stats->rx_bytes += len;
return 1; return 1;
} }