* [PATCH] vxlan: fix a use after free in vxlan_encap_bypass
@ 2014-10-16 0:49 roy.qing.li
2014-10-16 3:31 ` David Miller
0 siblings, 1 reply; 2+ messages in thread
From: roy.qing.li @ 2014-10-16 0:49 UTC (permalink / raw)
To: netdev
From: Li RongQing <roy.qing.li@gmail.com>
when netif_rx() is done, the netif_rx handled skb maybe be freed,
and should not be used.
Signed-off-by: Li RongQing <roy.qing.li@gmail.com>
---
drivers/net/vxlan.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
index 6f83be7..f677cd0 100644
--- a/drivers/net/vxlan.c
+++ b/drivers/net/vxlan.c
@@ -1668,6 +1668,8 @@ static void vxlan_encap_bypass(struct sk_buff *skb, struct vxlan_dev *src_vxlan,
struct pcpu_sw_netstats *tx_stats, *rx_stats;
union vxlan_addr loopback;
union vxlan_addr *remote_ip = &dst_vxlan->default_dst.remote_ip;
+ struct net_device *dev = skb->dev;
+ int len = skb->len;
tx_stats = this_cpu_ptr(src_vxlan->dev->tstats);
rx_stats = this_cpu_ptr(dst_vxlan->dev->tstats);
@@ -1691,16 +1693,16 @@ static void vxlan_encap_bypass(struct sk_buff *skb, struct vxlan_dev *src_vxlan,
u64_stats_update_begin(&tx_stats->syncp);
tx_stats->tx_packets++;
- tx_stats->tx_bytes += skb->len;
+ tx_stats->tx_bytes += len;
u64_stats_update_end(&tx_stats->syncp);
if (netif_rx(skb) == NET_RX_SUCCESS) {
u64_stats_update_begin(&rx_stats->syncp);
rx_stats->rx_packets++;
- rx_stats->rx_bytes += skb->len;
+ rx_stats->rx_bytes += len;
u64_stats_update_end(&rx_stats->syncp);
} else {
- skb->dev->stats.rx_dropped++;
+ dev->stats.rx_dropped++;
}
}
--
1.7.10.4
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] vxlan: fix a use after free in vxlan_encap_bypass
2014-10-16 0:49 [PATCH] vxlan: fix a use after free in vxlan_encap_bypass roy.qing.li
@ 2014-10-16 3:31 ` David Miller
0 siblings, 0 replies; 2+ messages in thread
From: David Miller @ 2014-10-16 3:31 UTC (permalink / raw)
To: roy.qing.li; +Cc: netdev
From: roy.qing.li@gmail.com
Date: Thu, 16 Oct 2014 08:49:41 +0800
> From: Li RongQing <roy.qing.li@gmail.com>
>
> when netif_rx() is done, the netif_rx handled skb maybe be freed,
> and should not be used.
>
> Signed-off-by: Li RongQing <roy.qing.li@gmail.com>
Looks good, applied, and queued up for -stable thanks!
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2014-10-16 3:31 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2014-10-16 0:49 [PATCH] vxlan: fix a use after free in vxlan_encap_bypass roy.qing.li
2014-10-16 3:31 ` David Miller
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).