| Message ID | 1528064275-3205-1-git-send-email-subashab@codeaurora.org |
|---|---|
| State | Changes Requested, archived |
| Delegated to: | David Miller |
| Headers | show |
| Series | [net] net: qualcomm: rmnet: Fix use after free while sending command ack | expand |
From: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org> Date: Sun, 3 Jun 2018 16:17:55 -0600 > When sending an ack to a command packet, the skb is still referenced > after it is sent to the real device. Since the real device could > free the skb, the device pointer would be invalid. > > Fixes: ceed73a2cf4a ("drivers: net: ethernet: qualcomm: rmnet: Initial implementation") > Signed-off-by: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org> This doesn't apply cleanly to the current net-next tree, please respin.
diff --git a/drivers/net/ethernet/qualcomm/rmnet/rmnet_map_command.c b/drivers/net/ethernet/qualcomm/rmnet/rmnet_map_command.c index 78fdad0..f530b07 100644 --- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_map_command.c +++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_map_command.c @@ -67,6 +67,7 @@ static void rmnet_map_send_ack(struct sk_buff *skb, struct rmnet_port *port) { struct rmnet_map_control_command *cmd; + struct net_device *dev = skb->dev; int xmit_status; if (port->data_format & RMNET_FLAGS_INGRESS_MAP_CKSUMV4) { @@ -86,9 +87,9 @@ static void rmnet_map_send_ack(struct sk_buff *skb, cmd = RMNET_MAP_GET_CMD_START(skb); cmd->cmd_type = type & 0x03; - netif_tx_lock(skb->dev); - xmit_status = skb->dev->netdev_ops->ndo_start_xmit(skb, skb->dev); - netif_tx_unlock(skb->dev); + netif_tx_lock(dev); + xmit_status = dev->netdev_ops->ndo_start_xmit(skb, dev); + netif_tx_unlock(dev); } /* Process MAP command frame and send N/ACK message as appropriate. Message cmd
When sending an ack to a command packet, the skb is still referenced after it is sent to the real device. Since the real device could free the skb, the device pointer would be invalid. Fixes: ceed73a2cf4a ("drivers: net: ethernet: qualcomm: rmnet: Initial implementation") Signed-off-by: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org> --- drivers/net/ethernet/qualcomm/rmnet/rmnet_map_command.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)