diff options
| author |   Tho Vu <tho.vu.wh@rvc.renesas.com> | 2019-08-16 17:17:02 +0200 |
|---|---|---|
| committer |   David S. Miller <davem@davemloft.net> | 2019-08-18 14:19:14 -0700 |
| commit | cfef46d692efd852a0da6803f920cc756eea2855 (patch) | |
| tree | f3ad1784d32745cfc43bba49b78b46b88f6a674d /net/rxrpc | |
| parent | Merge branch 'flow_offload-hardware-priority-fixes' (diff) | |
| download | linux-dev-cfef46d692efd852a0da6803f920cc756eea2855.tar.xz linux-dev-cfef46d692efd852a0da6803f920cc756eea2855.zip | |
ravb: Fix use-after-free ravb_tstamp_skb
When a Tx timestamp is requested, a pointer to the skb is stored in the
ravb_tstamp_skb struct. This was done without an skb_get. There exists
the possibility that the skb could be freed by ravb_tx_free (when
ravb_tx_free is called from ravb_start_xmit) before the timestamp was
processed, leading to a use-after-free bug.
Use skb_get when filling a ravb_tstamp_skb struct, and add appropriate
frees/consumes when a ravb_tstamp_skb struct is freed.
Fixes: c156633f1353 ("Renesas Ethernet AVB driver proper")
Signed-off-by: Tho Vu <tho.vu.wh@rvc.renesas.com>
Signed-off-by: Kazuya Mizuguchi <kazuya.mizuguchi.ks@renesas.com>
Signed-off-by: Simon Horman <horms+renesas@verge.net.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to '')
0 files changed, 0 insertions, 0 deletions