diff options
| author | Marc Kleine-Budde <mkl@pengutronix.de> | 2015-07-11 21:16:08 +0200 |
|---|---|---|
| committer | Marc Kleine-Budde <mkl@pengutronix.de> | 2015-07-15 09:04:27 +0200 |
| commit | a2e78cf7a3f562edca4230b188c8832b6214eccd (patch) | |
| tree | 6bab018105213b0b70bb2d2d55487074637569ea /drivers | |
| parent | can: grcan: don't touch skb after netif_rx() (diff) | |
| download | linux-a2e78cf7a3f562edca4230b188c8832b6214eccd.tar.xz linux-a2e78cf7a3f562edca4230b188c8832b6214eccd.zip | |
can: slcan: don't touch skb after netif_rx_ni()
There is no guarantee that the skb is in the same state after calling
net_receive_skb() or netif_rx(). It might be freed or reused. Not really
harmful as its a read access, except you turn on the proper debugging options
which catch a use after free.
Cc: Oliver Hartkopp <socketcan@hartkopp.net>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/net/can/slcan.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/net/can/slcan.c b/drivers/net/can/slcan.c index a23a7af8eb9a..9a3f15cb7ef4 100644 --- a/drivers/net/can/slcan.c +++ b/drivers/net/can/slcan.c @@ -218,10 +218,10 @@ static void slc_bump(struct slcan *sl) memcpy(skb_put(skb, sizeof(struct can_frame)), &cf, sizeof(struct can_frame)); - netif_rx_ni(skb); sl->dev->stats.rx_packets++; sl->dev->stats.rx_bytes += cf.can_dlc; + netif_rx_ni(skb); } /* parse tty input stream */ |