From: Jakub Kicinski Date: Fri, 20 Jun 2025 17:40:07 +0000 (-0700) Subject: netdevsim: fix UaF when counting Tx stats X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=5e95c0a3a55aea490420bd6994805edb050cc86b;p=thirdparty%2Fkernel%2Flinux.git netdevsim: fix UaF when counting Tx stats skb may be freed as soon as we put it on the rx queue. Use the len variable like the code did prior to the conversion. Fixes: f9e2511d80c2 ("netdevsim: migrate to dstats stats collection") Signed-off-by: Jakub Kicinski Acked-by: David S. Miller Reviewed-by: Breno Leitao Signed-off-by: David S. Miller --- diff --git a/drivers/net/netdevsim/netdev.c b/drivers/net/netdevsim/netdev.c index 7f2809be5d483..e36d3e846c2dc 100644 --- a/drivers/net/netdevsim/netdev.c +++ b/drivers/net/netdevsim/netdev.c @@ -93,7 +93,7 @@ static netdev_tx_t nsim_start_xmit(struct sk_buff *skb, struct net_device *dev) hrtimer_start(&rq->napi_timer, us_to_ktime(5), HRTIMER_MODE_REL); rcu_read_unlock(); - dev_dstats_tx_add(dev, skb->len); + dev_dstats_tx_add(dev, len); return NETDEV_TX_OK; out_drop_free: