rapidio/rionet: do not free skb before reading its length

Browse source

skb is freed via dev_kfree_skb_any, however, skb->len is read then. This
may result in a use-after-free bug.

Fixes: e6161d6426 ("rapidio/rionet: rework driver initialization and removal")
Signed-off-by: Pan Bian <bianpan2016@163.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

...

This commit is contained in:

Pan Bian 2018-11-28 14:53:19 +08:00 • committed by David S. Miller

parent 4df5ce9bc0

commit cfc435198f

1 changed files with 1 additions and 1 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

2

drivers/net/rionet.c

View file