diff options
| author | Dan Carpenter <error27@gmail.com> | 2022-11-23 09:43:14 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2023-01-14 12:16:00 +0300 |
| commit | daa8045a991363ccdae5615d170f35aa1135e7a7 (patch) | |
| tree | 8ddccef3840e2915591dbe3975925034e87cacd1 /drivers/staging | |
| parent | 46b3885c8cb4e5c9dd0d01ef2b22468a2a962cf1 (diff) | |
| download | linux-daa8045a991363ccdae5615d170f35aa1135e7a7.tar.xz | |
staging: rtl8192u: Fix use after free in ieee80211_rx()
[ Upstream commit bcc5e2dcf09089b337b76fc1a589f6ff95ca19ac ]
We cannot dereference the "skb" pointer after calling
ieee80211_monitor_rx(), because it is a use after free.
Fixes: 8fc8598e61f6 ("Staging: Added Realtek rtl8192u driver to staging")
Signed-off-by: Dan Carpenter <error27@gmail.com>
Link: https://lore.kernel.org/r/Y33BArx3k/aw6yv/@kili
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'drivers/staging')
| -rw-r--r-- | drivers/staging/rtl8192u/ieee80211/ieee80211_rx.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/drivers/staging/rtl8192u/ieee80211/ieee80211_rx.c b/drivers/staging/rtl8192u/ieee80211/ieee80211_rx.c index b6fee7230ce0..3871437f4708 100644 --- a/drivers/staging/rtl8192u/ieee80211/ieee80211_rx.c +++ b/drivers/staging/rtl8192u/ieee80211/ieee80211_rx.c @@ -954,9 +954,11 @@ int ieee80211_rx(struct ieee80211_device *ieee, struct sk_buff *skb, #endif if (ieee->iw_mode == IW_MODE_MONITOR) { + unsigned int len = skb->len; + ieee80211_monitor_rx(ieee, skb, rx_stats); stats->rx_packets++; - stats->rx_bytes += skb->len; + stats->rx_bytes += len; return 1; } |