aboutsummaryrefslogtreecommitdiffstats
path: root/net/rxrpc/input.c
diff options
context:
space:
mode:
authorTho Vu <tho.vu.wh@rvc.renesas.com>2019-08-16 17:17:02 +0200
committerDavid S. Miller <davem@davemloft.net>2019-08-18 14:19:14 -0700
commitcfef46d692efd852a0da6803f920cc756eea2855 (patch)
treef3ad1784d32745cfc43bba49b78b46b88f6a674d /net/rxrpc/input.c
parentMerge branch 'flow_offload-hardware-priority-fixes' (diff)
downloadlinux-dev-cfef46d692efd852a0da6803f920cc756eea2855.tar.xz
linux-dev-cfef46d692efd852a0da6803f920cc756eea2855.zip
ravb: Fix use-after-free ravb_tstamp_skb
When a Tx timestamp is requested, a pointer to the skb is stored in the ravb_tstamp_skb struct. This was done without an skb_get. There exists the possibility that the skb could be freed by ravb_tx_free (when ravb_tx_free is called from ravb_start_xmit) before the timestamp was processed, leading to a use-after-free bug. Use skb_get when filling a ravb_tstamp_skb struct, and add appropriate frees/consumes when a ravb_tstamp_skb struct is freed. Fixes: c156633f1353 ("Renesas Ethernet AVB driver proper") Signed-off-by: Tho Vu <tho.vu.wh@rvc.renesas.com> Signed-off-by: Kazuya Mizuguchi <kazuya.mizuguchi.ks@renesas.com> Signed-off-by: Simon Horman <horms+renesas@verge.net.au> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to '')
0 files changed, 0 insertions, 0 deletions