Unverified Commit 69fb2d5a authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!1803 net: vmxnet3: fix possible use-after-free bugs in vmxnet3_rq_alloc_rx_buf() 

Merge Pull Request from: @ci-robot 
 
PR sync from: Lu Wei <luwei32@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/ADZZ2NY67FCOABLLQEWR7B5IMUW7GNHN/ 
 
https://gitee.com/src-openeuler/kernel/issues/I7TTDS 
 
Link:https://gitee.com/openeuler/kernel/pulls/1803

 

Reviewed-by: default avatarLiu YongQiang <liuyongqiang13@huawei.com>
Signed-off-by: default avatarLiu YongQiang <liuyongqiang13@huawei.com>
parents ae08f272 b0f66bf2

drivers/net/vmxnet3/vmxnet3_drv.c

+2 −0
Original line number Diff line number Diff line
@@ -595,6 +595,7 @@ vmxnet3_rq_alloc_rx_buf(struct vmxnet3_rx_queue *rq, u32 ring_idx, 
				if (dma_mapping_error(&adapter->pdev->dev,

						      rbi->dma_addr)) {

					dev_kfree_skb_any(rbi->skb);

					rbi->skb = NULL;

					rq->stats.rx_buf_alloc_failure++;

					break;

				}
@@ -619,6 +620,7 @@ vmxnet3_rq_alloc_rx_buf(struct vmxnet3_rx_queue *rq, u32 ring_idx, 
				if (dma_mapping_error(&adapter->pdev->dev,

						      rbi->dma_addr)) {

					put_page(rbi->page);

					rbi->page = NULL;

					rq->stats.rx_buf_alloc_failure++;

					break;

				}