| From f0201ec2421d9a269ff6e7c29b3924b121eccf68 Mon Sep 17 00:00:00 2001 |
| From: Sasha Levin <sashal@kernel.org> |
| Date: Fri, 14 Mar 2025 13:10:57 +0300 |
| Subject: net: atm: fix use after free in lec_send() |
| |
| From: Dan Carpenter <dan.carpenter@linaro.org> |
| |
| [ Upstream commit f3009d0d6ab78053117f8857b921a8237f4d17b3 ] |
| |
| The ->send() operation frees skb so save the length before calling |
| ->send() to avoid a use after free. |
| |
| Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") |
| Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> |
| Reviewed-by: Simon Horman <horms@kernel.org> |
| Link: https://patch.msgid.link/c751531d-4af4-42fe-affe-6104b34b791d@stanley.mountain |
| Signed-off-by: Paolo Abeni <pabeni@redhat.com> |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| net/atm/lec.c | 3 ++- |
| 1 file changed, 2 insertions(+), 1 deletion(-) |
| |
| diff --git a/net/atm/lec.c b/net/atm/lec.c |
| index 6257bf12e5a00..ac3cfc1ae5102 100644 |
| --- a/net/atm/lec.c |
| +++ b/net/atm/lec.c |
| @@ -181,6 +181,7 @@ static void |
| lec_send(struct atm_vcc *vcc, struct sk_buff *skb) |
| { |
| struct net_device *dev = skb->dev; |
| + unsigned int len = skb->len; |
| |
| ATM_SKB(skb)->vcc = vcc; |
| atm_account_tx(vcc, skb); |
| @@ -191,7 +192,7 @@ lec_send(struct atm_vcc *vcc, struct sk_buff *skb) |
| } |
| |
| dev->stats.tx_packets++; |
| - dev->stats.tx_bytes += skb->len; |
| + dev->stats.tx_bytes += len; |
| } |
| |
| static void lec_tx_timeout(struct net_device *dev, unsigned int txqueue) |
| -- |
| 2.39.5 |
| |
