staging: rtl8192e: fix potential use after free
commit b7aa39a2ed
upstream.
The variable skb is released via kfree_skb() when the return value of
_rtl92e_tx is not zero. However, after that, skb is accessed again to
read its length, which may result in a use after free bug. This patch
fixes the bug by moving the release operation to where skb is never
used later.
Signed-off-by: Pan Bian <bianpan2016@163.com>
Reviewed-by: Dan Carpenter <dan.carpenter@oracle.com>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/1572965351-6745-1-git-send-email-bianpan2016@163.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
5.4-rM2-2.2.x-imx-squashed
parent
bb2135c6a5
commit
ab1908cbe2
|
@ -1616,14 +1616,15 @@ static void _rtl92e_hard_data_xmit(struct sk_buff *skb, struct net_device *dev,
|
|||
memcpy((unsigned char *)(skb->cb), &dev, sizeof(dev));
|
||||
skb_push(skb, priv->rtllib->tx_headroom);
|
||||
ret = _rtl92e_tx(dev, skb);
|
||||
if (ret != 0)
|
||||
kfree_skb(skb);
|
||||
|
||||
if (queue_index != MGNT_QUEUE) {
|
||||
priv->rtllib->stats.tx_bytes += (skb->len -
|
||||
priv->rtllib->tx_headroom);
|
||||
priv->rtllib->stats.tx_packets++;
|
||||
}
|
||||
|
||||
if (ret != 0)
|
||||
kfree_skb(skb);
|
||||
}
|
||||
|
||||
static int _rtl92e_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
|
||||
|
|
Loading…
Reference in New Issue