Commit 06bf1ce6 authored by Matt Johnston's avatar Matt Johnston Committed by Jakub Kicinski
Browse files

mctp i2c: Fix potential use-after-free 



The skb is handed off to netif_rx() which may free it.
Found by Smatch.

Reported-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarMatt Johnston <matt@codeconstruct.com.au>
Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parent f62457df

drivers/net/mctp/mctp-i2c.c

+1 −1
Original line number Diff line number Diff line
@@ -338,7 +338,7 @@ static int mctp_i2c_recv(struct mctp_i2c_dev *midev) 


	if (status == NET_RX_SUCCESS) {

		ndev->stats.rx_packets++;

		ndev->stats.rx_bytes += skb->len;

		ndev->stats.rx_bytes += recvlen;

	} else {

		ndev->stats.rx_dropped++;

	}