Commit 288ada16 authored Nov 23, 2022 by Dan Carpenter Committed by Greg Kroah-Hartman Jan 18, 2023

staging: rtl8192u: Fix use after free in ieee80211_rx()



[ Upstream commit bcc5e2dcf09089b337b76fc1a589f6ff95ca19ac ]

We cannot dereference the "skb" pointer after calling
ieee80211_monitor_rx(), because it is a use after free.

Fixes: 8fc8598e ("Staging: Added Realtek rtl8192u driver to staging")
Signed-off-by: Dan Carpenter <error27@gmail.com>
Link: https://lore.kernel.org/r/Y33BArx3k/aw6yv/@kili


Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

parent c226717a

drivers/staging/rtl8192u/ieee80211/ieee80211_rx.c

+3 −1

Original line number	Diff line number	Diff line
		@@ -943,9 +943,11 @@ int ieee80211_rx(struct ieee80211_device ieee, struct sk_buff skb,
		#endif

		if (ieee->iw_mode == IW_MODE_MONITOR) {
		unsigned int len = skb->len;

		ieee80211_monitor_rx(ieee, skb, rx_stats);
		stats->rx_packets++;
		stats->rx_bytes += skb->len;
		stats->rx_bytes += len;
		return 1;
		}