diff options
| author | Dan Carpenter <dan.carpenter@linaro.org> | 2025-03-14 13:10:57 +0300 |
|---|---|---|
| committer | Paolo Abeni <pabeni@redhat.com> | 2025-03-20 10:45:29 +0100 |
| commit | f3009d0d6ab78053117f8857b921a8237f4d17b3 (patch) | |
| tree | 5da7071af45a6b53f57c77d9f4efb98551c20afd | |
| parent | 559847f56769037e5b2e0474d3dbff985b98083d (diff) | |
net: atm: fix use after free in lec_send()
The ->send() operation frees skb so save the length before calling
->send() to avoid a use after free.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/c751531d-4af4-42fe-affe-6104b34b791d@stanley.mountain
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
| -rw-r--r-- | net/atm/lec.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/net/atm/lec.c b/net/atm/lec.c index ffef658862db..a948dd47c3f3 100644 --- a/net/atm/lec.c +++ b/net/atm/lec.c @@ -181,6 +181,7 @@ static void lec_send(struct atm_vcc *vcc, struct sk_buff *skb) { struct net_device *dev = skb->dev; + unsigned int len = skb->len; ATM_SKB(skb)->vcc = vcc; atm_account_tx(vcc, skb); @@ -191,7 +192,7 @@ lec_send(struct atm_vcc *vcc, struct sk_buff *skb) } dev->stats.tx_packets++; - dev->stats.tx_bytes += skb->len; + dev->stats.tx_bytes += len; } static void lec_tx_timeout(struct net_device *dev, unsigned int txqueue) |