Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 09e086a5 authored by Dan Carpenter's avatar Dan Carpenter Committed by Greg Kroah-Hartman
Browse files

atm: idt77252: prevent use after free in dequeue_rx() 



[ Upstream commit a9a18e8f770c9b0703dab93580d0b02e199a4c79 ]

We can't dereference "skb" after calling vcc->push() because the skb
is released.

Fixes: 1da177e4 ("Linux-2.6.12-rc2")
Signed-off-by: default avatarDan Carpenter <dan.carpenter@linaro.org>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent 3b999c52

drivers/atm/idt77252.c

+5 −4
Original line number Diff line number Diff line
@@ -1117,8 +1117,8 @@ dequeue_rx(struct idt77252_dev *card, struct rsq_entry *rsqe) 
	rpp->len += skb->len;



	if (stat & SAR_RSQE_EPDU) {

		unsigned int len, truesize;

		unsigned char *l1l2;

		unsigned int len;



		l1l2 = (unsigned char *) ((unsigned long) skb->data + skb->len - 6);
@@ -1188,14 +1188,15 @@ dequeue_rx(struct idt77252_dev *card, struct rsq_entry *rsqe) 
		ATM_SKB(skb)->vcc = vcc;

		__net_timestamp(skb);



		truesize = skb->truesize;

		vcc->push(vcc, skb);

		atomic_inc(&vcc->stats->rx);



		if (skb->truesize > SAR_FB_SIZE_3)

		if (truesize > SAR_FB_SIZE_3)

			add_rx_skb(card, 3, SAR_FB_SIZE_3, 1);

		else if (skb->truesize > SAR_FB_SIZE_2)

		else if (truesize > SAR_FB_SIZE_2)

			add_rx_skb(card, 2, SAR_FB_SIZE_2, 1);

		else if (skb->truesize > SAR_FB_SIZE_1)

		else if (truesize > SAR_FB_SIZE_1)

			add_rx_skb(card, 1, SAR_FB_SIZE_1, 1);

		else

			add_rx_skb(card, 0, SAR_FB_SIZE_0, 1);