Unverified Commit 0199374d authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!12207 v2 atm: idt77252: prevent use after free in dequeue_rx() 

Merge Pull Request from: @ci-robot 
 
PR sync from: Peng Zhang <zhangpeng362@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/SPRL2L2QCN62LCCH7ICFM77KEXE5OOJR/ 
 
https://gitee.com/src-openeuler/kernel/issues/IAOXZG 
 
Link:https://gitee.com/openeuler/kernel/pulls/12207

 

Reviewed-by: default avatarYang Yingliang <yangyingliang@huawei.com>
Signed-off-by: default avatarYang Yingliang <yangyingliang@huawei.com>
parents 7c42e37b 12028c15

drivers/atm/idt77252.c

+5 −4
Original line number Diff line number Diff line
@@ -1118,8 +1118,8 @@ dequeue_rx(struct idt77252_dev *card, struct rsq_entry *rsqe) 
	rpp->len += skb->len;



	if (stat & SAR_RSQE_EPDU) {

		unsigned int len, truesize;

		unsigned char *l1l2;

		unsigned int len;



		l1l2 = (unsigned char *) ((unsigned long) skb->data + skb->len - 6);
@@ -1189,14 +1189,15 @@ dequeue_rx(struct idt77252_dev *card, struct rsq_entry *rsqe) 
		ATM_SKB(skb)->vcc = vcc;

		__net_timestamp(skb);



		truesize = skb->truesize;

		vcc->push(vcc, skb);

		atomic_inc(&vcc->stats->rx);



		if (skb->truesize > SAR_FB_SIZE_3)

		if (truesize > SAR_FB_SIZE_3)

			add_rx_skb(card, 3, SAR_FB_SIZE_3, 1);

		else if (skb->truesize > SAR_FB_SIZE_2)

		else if (truesize > SAR_FB_SIZE_2)

			add_rx_skb(card, 2, SAR_FB_SIZE_2, 1);

		else if (skb->truesize > SAR_FB_SIZE_1)

		else if (truesize > SAR_FB_SIZE_1)

			add_rx_skb(card, 1, SAR_FB_SIZE_1, 1);

		else

			add_rx_skb(card, 0, SAR_FB_SIZE_0, 1);