]> git.baikalelectronics.ru Git - kernel.git/commit
asix: Add rx->ax_skb = NULL after usbnet_skb_return()
authorDean Jenkins <Dean_Jenkins@mentor.com>
Mon, 7 Aug 2017 08:50:14 +0000 (09:50 +0100)
committerDavid S. Miller <davem@davemloft.net>
Mon, 7 Aug 2017 17:10:19 +0000 (10:10 -0700)
commit2f01855f8e4f6cf16b7bd3171a5dd0141ac5fd73
treec39bb8673bb205b0a073a33f29d3fbcca4a890ef
parented5bdedc0541d69c7e774f82cc97b3cc56ef178b
asix: Add rx->ax_skb = NULL after usbnet_skb_return()

In asix_rx_fixup_internal() there is a risk that rx->ax_skb gets
reused after passing the Ethernet frame into the network stack via
usbnet_skb_return().

The risks include:

a) asynchronously freeing rx->ax_skb after passing the netdev buffer
   to the NAPI layer which might corrupt the backlog queue.

b) erroneously reusing rx->ax_skb such as calling skb_put_data() multiple
   times which causes writing off the end of the netdev buffer.

Therefore add a defensive rx->ax_skb = NULL after usbnet_skb_return()
so that it is not possible to free rx->ax_skb or to apply
skb_put_data() too many times.

Signed-off-by: Dean Jenkins <Dean_Jenkins@mentor.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
drivers/net/usb/asix_common.c