Commit fc7f750d authored by Dan Carpenter's avatar Dan Carpenter Committed by Greg Kroah-Hartman
Browse files

staging: gdm724x: fix use after free in gdm_lte_rx() 



The netif_rx_ni() function frees the skb so we can't dereference it to
save the skb->len.

Fixes: 61e12104 ("staging: gdm7240: adding LTE USB driver")
Cc: stable <stable@vger.kernel.org>
Reported-by: default avatarkernel test robot <lkp@intel.com>
Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Link: https://lore.kernel.org/r/20220228074331.GA13685@kili


Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 7e57714c

drivers/staging/gdm724x/gdm_lte.c

+3 −2
Original line number Original line Diff line number Diff line
@@ -76,14 +76,15 @@ static void tx_complete(void *arg) 




static int gdm_lte_rx(struct sk_buff *skb, struct nic *nic, int nic_type)

static int gdm_lte_rx(struct sk_buff *skb, struct nic *nic, int nic_type)

{

{

	int ret;

	int ret, len;





	len = skb->len + ETH_HLEN;

	ret = netif_rx_ni(skb);

	ret = netif_rx_ni(skb);

	if (ret == NET_RX_DROP) {

	if (ret == NET_RX_DROP) {

		nic->stats.rx_dropped++;

		nic->stats.rx_dropped++;

	} else {

	} else {

		nic->stats.rx_packets++;

		nic->stats.rx_packets++;

		nic->stats.rx_bytes += skb->len + ETH_HLEN;

		nic->stats.rx_bytes += len;

	}

	}





	return 0;

	return 0;