Commit 22889dbb authored by Dean Jenkins's avatar Dean Jenkins Committed by David S. Miller

asix: Add rx->ax_skb = NULL after usbnet_skb_return()

In asix_rx_fixup_internal() there is a risk that rx->ax_skb gets
reused after passing the Ethernet frame into the network stack via
usbnet_skb_return().

The risks include:

a) asynchronously freeing rx->ax_skb after passing the netdev buffer
   to the NAPI layer which might corrupt the backlog queue.

b) erroneously reusing rx->ax_skb such as calling skb_put_data() multiple
   times which causes writing off the end of the netdev buffer.

Therefore add a defensive rx->ax_skb = NULL after usbnet_skb_return()
so that it is not possible to free rx->ax_skb or to apply
skb_put_data() too many times.
Signed-off-by: default avatarDean Jenkins <Dean_Jenkins@mentor.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent f9ea3225
...@@ -168,8 +168,10 @@ int asix_rx_fixup_internal(struct usbnet *dev, struct sk_buff *skb, ...@@ -168,8 +168,10 @@ int asix_rx_fixup_internal(struct usbnet *dev, struct sk_buff *skb,
if (rx->ax_skb) { if (rx->ax_skb) {
skb_put_data(rx->ax_skb, skb->data + offset, skb_put_data(rx->ax_skb, skb->data + offset,
copy_length); copy_length);
if (!rx->remaining) if (!rx->remaining) {
usbnet_skb_return(dev, rx->ax_skb); usbnet_skb_return(dev, rx->ax_skb);
rx->ax_skb = NULL;
}
} }
offset += (copy_length + 1) & 0xfffe; offset += (copy_length + 1) & 0xfffe;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment