diff options
| author | Dean Jenkins <Dean_Jenkins@mentor.com> | 2017-08-07 10:50:14 +0200 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2017-08-07 19:10:19 +0200 |
| commit | 22889dbbd98a0e3390e9120074c39c6e5a3fea5e (patch) | |
| tree | c39bb8673bb205b0a073a33f29d3fbcca4a890ef | |
| parent | bpf: fix selftest/bpf/test_pkt_md_access on s390x (diff) | |
| download | linux-22889dbbd98a0e3390e9120074c39c6e5a3fea5e.tar.xz linux-22889dbbd98a0e3390e9120074c39c6e5a3fea5e.zip | |
asix: Add rx->ax_skb = NULL after usbnet_skb_return()
In asix_rx_fixup_internal() there is a risk that rx->ax_skb gets
reused after passing the Ethernet frame into the network stack via
usbnet_skb_return().
The risks include:
a) asynchronously freeing rx->ax_skb after passing the netdev buffer
to the NAPI layer which might corrupt the backlog queue.
b) erroneously reusing rx->ax_skb such as calling skb_put_data() multiple
times which causes writing off the end of the netdev buffer.
Therefore add a defensive rx->ax_skb = NULL after usbnet_skb_return()
so that it is not possible to free rx->ax_skb or to apply
skb_put_data() too many times.
Signed-off-by: Dean Jenkins <Dean_Jenkins@mentor.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
| -rw-r--r-- | drivers/net/usb/asix_common.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/drivers/net/usb/asix_common.c b/drivers/net/usb/asix_common.c index 7847436c441e..6983b6bd8cf9 100644 --- a/drivers/net/usb/asix_common.c +++ b/drivers/net/usb/asix_common.c @@ -168,8 +168,10 @@ int asix_rx_fixup_internal(struct usbnet *dev, struct sk_buff *skb, if (rx->ax_skb) { skb_put_data(rx->ax_skb, skb->data + offset, copy_length); - if (!rx->remaining) + if (!rx->remaining) { usbnet_skb_return(dev, rx->ax_skb); + rx->ax_skb = NULL; + } } offset += (copy_length + 1) & 0xfffe; |