firewire: net: fix use after free in fwnet_finish_incoming_packet()

The netif_rx() function frees the skb so we can't dereference it to save the skb->len.

Zhang Shurong committed 3 years ago

Commit 3ff25671 parent 06f45431 file · +4 −2Browse files

Unified · Split

@@ -479,7 +479,7 @@ static int fwnet_finish_incoming_packet(struct net_device *net, · 478 unmodified lines
479	479	struct sk_buff *skb, u16 source_node_id,
480	480	bool is_broadcast, u16 ether_type)
481	481	{
482		− int status;
	482	+ int status, len;
483	483
484	484	switch (ether_type) {
485	485	case ETH_P_ARP:
@@ -533,13 +533,15 @@ static int fwnet_finish_incoming_packet(struct net_device *net, · 47 unmodified lines
533	533	}
534	534	skb->protocol = protocol;
535	535	}
	536	+
	537	+ len = skb->len;
536	538	status = netif_rx(skb);
537	539	if (status == NET_RX_DROP) {
538	540	net->stats.rx_errors++;
539	541	net->stats.rx_dropped++;
540	542	} else {
541	543	net->stats.rx_packets++;
542		− net->stats.rx_bytes += skb->len;
	544	+ net->stats.rx_bytes += len;
543	545	}
544	546
545	547	return 0;