diff options
| author | Bogdan Purcareata <bogdan.purcareata@nxp.com> | 2017-07-20 10:58:37 +0000 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2017-07-30 08:25:03 -0700 |
| commit | 3c70d958cf1ee81141d00ecbf54b4999060eeeaa (patch) | |
| tree | 9521c76fa6c17c63ebe48fc7854f232715e2fe73 /drivers/staging/fsl-dpaa2 | |
| parent | 5be271ff96ec1a19c332bbb610662d83aa86799d (diff) | |
staging: fsl-dpaa2/eth: Fix skb use after free
Once a Tx frame descriptor is enqueued, an interrupt might be triggered
to process the Tx confirmation and free the skb, hitting a memory use
after free when updating the tx_bytes statistic based on skb->len.
Use the frame descriptor length instead.
Signed-off-by: Bogdan Purcareata <bogdan.purcareata@nxp.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/staging/fsl-dpaa2')
| -rw-r--r-- | drivers/staging/fsl-dpaa2/ethernet/dpaa2-eth.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/staging/fsl-dpaa2/ethernet/dpaa2-eth.c b/drivers/staging/fsl-dpaa2/ethernet/dpaa2-eth.c index b9a0a315e6fb..0f3e497254a7 100644 --- a/drivers/staging/fsl-dpaa2/ethernet/dpaa2-eth.c +++ b/drivers/staging/fsl-dpaa2/ethernet/dpaa2-eth.c @@ -616,7 +616,7 @@ static netdev_tx_t dpaa2_eth_tx(struct sk_buff *skb, struct net_device *net_dev) free_tx_fd(priv, &fd, NULL); } else { percpu_stats->tx_packets++; - percpu_stats->tx_bytes += skb->len; + percpu_stats->tx_bytes += dpaa2_fd_get_len(&fd); } return NETDEV_TX_OK; |