netdevsim: fix UaF when counting Tx stats

skb may be freed as soon as we put it on the rx queue.
Use the len variable like the code did prior to the conversion.

Fixes: f9e2511d80c2 ("netdevsim: migrate to dstats stats collection")
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Acked-by: David S. Miller <davem@davemloft.net>
Reviewed-by: Breno Leitao <leitao@debian.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/drivers/net/netdevsim/netdev.c b/drivers/net/netdevsim/netdev.c
index 7f2809be5d4833b729c570c6d796ce696cdd4461..e36d3e846c2dc314182efd1af03b59270397b007 100644 (file)
--- a/drivers/net/netdevsim/netdev.c
+++ b/drivers/net/netdevsim/netdev.c
@@ -93,7 +93,7 @@ static netdev_tx_t nsim_start_xmit(struct sk_buff *skb, struct net_device *dev)
                hrtimer_start(&rq->napi_timer, us_to_ktime(5), HRTIMER_MODE_REL);
 
        rcu_read_unlock();
-       dev_dstats_tx_add(dev, skb->len);
+       dev_dstats_tx_add(dev, len);
        return NETDEV_TX_OK;
 
 out_drop_free: