github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-05-30 10:04:04 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

netdevsim: fix UaF when counting Tx stats

Browse Source 
skb may be freed as soon as we put it on the rx queue.
Use the len variable like the code did prior to the conversion.

Fixes: f9e2511d80 ("netdevsim: migrate to dstats stats collection")
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Acked-by: David S. Miller <davem@davemloft.net>
Reviewed-by: Breno Leitao <leitao@debian.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Jakub Kicinski 2025-06-20 10:40:07 -07:00 committed by David S. Miller
parent 14966a8df7
commit 5e95c0a3a5
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
drivers/net/netdevsim/netdev.c
View File

@ -93,7 +93,7 @@ static netdev_tx_t nsim_start_xmit(struct sk_buff *skb, struct net_device *dev)
hrtimer_start(&rq->napi_timer, us_to_ktime(5), HRTIMER_MODE_REL);
rcu_read_unlock();
dev_dstats_tx_add(dev, skb->len);
dev_dstats_tx_add(dev, len);
return NETDEV_TX_OK;
out_drop_free: