Skip to content

Commit 433c07a

Browse files
liujian56Paolo Abeni
authored andcommitted
net: hisilicon: Fix potential use-after-free in hix5hd2_rx()
The skb is delivered to napi_gro_receive() which may free it, after calling this, dereferencing skb may trigger use-after-free. Fixes: 57c5bc9 ("net: hisilicon: add hix5hd2 mac driver") Signed-off-by: Liu Jian <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Paolo Abeni <[email protected]>
1 parent cb37617 commit 433c07a

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

drivers/net/ethernet/hisilicon/hix5hd2_gmac.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -550,7 +550,7 @@ static int hix5hd2_rx(struct net_device *dev, int limit)
550550
skb->protocol = eth_type_trans(skb, dev);
551551
napi_gro_receive(&priv->napi, skb);
552552
dev->stats.rx_packets++;
553-
dev->stats.rx_bytes += skb->len;
553+
dev->stats.rx_bytes += len;
554554
next:
555555
pos = dma_ring_incr(pos, RX_DESC_NUM);
556556
}

0 commit comments

Comments
 (0)