diff options
| author | Matt Johnston <matt@codeconstruct.com.au> | 2022-02-25 08:39:37 +0300 |
|---|---|---|
| committer | Jakub Kicinski <kuba@kernel.org> | 2022-02-26 09:23:29 +0300 |
| commit | 06bf1ce69d55729dc132d423d626398254fedc58 (patch) | |
| tree | 98f4322027d4904f8cc4c1f262c3b572eb49ae75 /drivers/net/mctp | |
| parent | f62457df5cc46ea0729fface07ffa885e85ef404 (diff) | |
| download | linux-06bf1ce69d55729dc132d423d626398254fedc58.tar.xz | |
mctp i2c: Fix potential use-after-free
The skb is handed off to netif_rx() which may free it.
Found by Smatch.
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Matt Johnston <matt@codeconstruct.com.au>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Diffstat (limited to 'drivers/net/mctp')
| -rw-r--r-- | drivers/net/mctp/mctp-i2c.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/net/mctp/mctp-i2c.c b/drivers/net/mctp/mctp-i2c.c index 365c3dfd4034..470682c88d7e 100644 --- a/drivers/net/mctp/mctp-i2c.c +++ b/drivers/net/mctp/mctp-i2c.c @@ -338,7 +338,7 @@ static int mctp_i2c_recv(struct mctp_i2c_dev *midev) if (status == NET_RX_SUCCESS) { ndev->stats.rx_packets++; - ndev->stats.rx_bytes += skb->len; + ndev->stats.rx_bytes += recvlen; } else { ndev->stats.rx_dropped++; } |