]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
net: atlantic: fix use after free kasan warn
authorPavel Belous <pbelous@marvell.com>
Fri, 14 Feb 2020 15:44:55 +0000 (18:44 +0300)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 5 Mar 2020 15:45:20 +0000 (16:45 +0100)
commit7b288eb4f7aeceee3980ba01f28fc341fbb90556
treec5ebaf05cdc50f5b74ca3c2de7842c33914b5c7a
parent88436c02f5da586d08cfa2c227c3ec18d4ffcda9
net: atlantic: fix use after free kasan warn

commit a4980919ad6a7be548d499bc5338015e1a9191c6 upstream.

skb->len is used to calculate statistics after xmit invocation.

Under a stress load it may happen that skb will be xmited,
rx interrupt will come and skb will be freed, all before xmit function
is even returned.

Eventually, skb->len will access unallocated area.

Moving stats calculation into tx_clean routine.

Fixes: 018423e90bee ("net: ethernet: aquantia: Add ring support code")
Reported-by: Christophe Vu-Brugier <cvubrugier@fastmail.fm>
Signed-off-by: Igor Russkikh <irusskikh@marvell.com>
Signed-off-by: Pavel Belous <pbelous@marvell.com>
Signed-off-by: Dmitry Bogdanov <dbogdanov@marvell.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/net/ethernet/aquantia/atlantic/aq_nic.c
drivers/net/ethernet/aquantia/atlantic/aq_ring.c