Commit 3602207c authored by Subash Abhinov Kasiviswanathan's avatar Subash Abhinov Kasiviswanathan Committed by David S. Miller

net: qualcomm: rmnet: Fix use after free while sending command ack

When sending an ack to a command packet, the skb is still referenced
after it is sent to the real device. Since the real device could
free the skb, the device pointer would be invalid.
Also, remove an unnecessary variable.

Fixes: ceed73a2 ("drivers: net: ethernet: qualcomm: rmnet: Initial implementation")
Signed-off-by: default avatarSubash Abhinov Kasiviswanathan <subashab@codeaurora.org>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 9deb441c
...@@ -67,7 +67,7 @@ static void rmnet_map_send_ack(struct sk_buff *skb, ...@@ -67,7 +67,7 @@ static void rmnet_map_send_ack(struct sk_buff *skb,
struct rmnet_port *port) struct rmnet_port *port)
{ {
struct rmnet_map_control_command *cmd; struct rmnet_map_control_command *cmd;
int xmit_status; struct net_device *dev = skb->dev;
if (port->data_format & RMNET_FLAGS_INGRESS_MAP_CKSUMV4) if (port->data_format & RMNET_FLAGS_INGRESS_MAP_CKSUMV4)
skb_trim(skb, skb_trim(skb,
...@@ -78,9 +78,9 @@ static void rmnet_map_send_ack(struct sk_buff *skb, ...@@ -78,9 +78,9 @@ static void rmnet_map_send_ack(struct sk_buff *skb,
cmd = RMNET_MAP_GET_CMD_START(skb); cmd = RMNET_MAP_GET_CMD_START(skb);
cmd->cmd_type = type & 0x03; cmd->cmd_type = type & 0x03;
netif_tx_lock(skb->dev); netif_tx_lock(dev);
xmit_status = skb->dev->netdev_ops->ndo_start_xmit(skb, skb->dev); dev->netdev_ops->ndo_start_xmit(skb, dev);
netif_tx_unlock(skb->dev); netif_tx_unlock(dev);
} }
/* Process MAP command frame and send N/ACK message as appropriate. Message cmd /* Process MAP command frame and send N/ACK message as appropriate. Message cmd
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment