diff options
| author | Bogdan Purcareata <bogdan.purcareata@nxp.com> | 2017-06-16 10:09:51 (GMT) |
|---|---|---|
| committer | Xie Xiaobo <xiaobo.xie@nxp.com> | 2017-09-25 07:25:37 (GMT) |
| commit | 4aeb8ce16ef7b36f1c92bac193f36a6491b47760 (patch) | |
| tree | 117aaa1aa2bf1fe1cff319e448781ab1fbeeabf6 /drivers/staging/fsl-dpaa2/ethernet | |
| parent | cd2d57ebb9e63f35e53e6f9fb15feeed2eaa067d (diff) | |
| download | linux-4aeb8ce16ef7b36f1c92bac193f36a6491b47760.tar.xz | |
staging: fsl-dpaa2/eth: Fix skb use after free
Once a Tx frame descriptor is enqueued, an interrupt might be triggered
to process the Tx confirmation and free the skb, hitting a memory use
after free when updating the tx_bytes statistic based on skb->len.
Use the frame descriptor length instead.
Signed-off-by: Bogdan Purcareata <bogdan.purcareata@nxp.com>
Diffstat (limited to 'drivers/staging/fsl-dpaa2/ethernet')
| -rw-r--r-- | drivers/staging/fsl-dpaa2/ethernet/dpaa2-eth.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/staging/fsl-dpaa2/ethernet/dpaa2-eth.c b/drivers/staging/fsl-dpaa2/ethernet/dpaa2-eth.c index dd33403..6b5b2be 100644 --- a/drivers/staging/fsl-dpaa2/ethernet/dpaa2-eth.c +++ b/drivers/staging/fsl-dpaa2/ethernet/dpaa2-eth.c @@ -763,7 +763,7 @@ static int dpaa2_eth_tx(struct sk_buff *skb, struct net_device *net_dev) free_tx_fd(priv, &fd, NULL); } else { percpu_stats->tx_packets++; - percpu_stats->tx_bytes += skb->len; + percpu_stats->tx_bytes += dpaa2_fd_get_len(&fd); } return NETDEV_TX_OK; |