From 5e95c0a3a55aea490420bd6994805edb050cc86b Mon Sep 17 00:00:00 2001 From: Jakub Kicinski Date: Fri, 20 Jun 2025 10:40:07 -0700 Subject: [PATCH] netdevsim: fix UaF when counting Tx stats skb may be freed as soon as we put it on the rx queue. Use the len variable like the code did prior to the conversion. Fixes: f9e2511d80c2 ("netdevsim: migrate to dstats stats collection") Signed-off-by: Jakub Kicinski Acked-by: David S. Miller Reviewed-by: Breno Leitao Signed-off-by: David S. Miller --- drivers/net/netdevsim/netdev.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/netdevsim/netdev.c b/drivers/net/netdevsim/netdev.c index 7f2809be5d483..e36d3e846c2dc 100644 --- a/drivers/net/netdevsim/netdev.c +++ b/drivers/net/netdevsim/netdev.c @@ -93,7 +93,7 @@ static netdev_tx_t nsim_start_xmit(struct sk_buff *skb, struct net_device *dev) hrtimer_start(&rq->napi_timer, us_to_ktime(5), HRTIMER_MODE_REL); rcu_read_unlock(); - dev_dstats_tx_add(dev, skb->len); + dev_dstats_tx_add(dev, len); return NETDEV_TX_OK; out_drop_free: -- 2.47.2