[PATCH net-next] netdevsim: fix UaF when counting Tx stats

[Jakub Kicinski <kuba@kernel.org>]

skb may be freed as soon as we put it on the rx queue.
Use the len variable like the code did prior to the conversion.

Fixes: f9e2511d80c2 ("netdevsim: migrate to dstats stats collection")
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
---
CC: leitao@debian.org
CC: joe@dama.to
---
 drivers/net/netdevsim/netdev.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/netdevsim/netdev.c b/drivers/net/netdevsim/netdev.c
index 7f2809be5d48..e36d3e846c2d 100644
--- a/drivers/net/netdevsim/netdev.c
+++ b/drivers/net/netdevsim/netdev.c
@@ -93,7 +93,7 @@ static netdev_tx_t nsim_start_xmit(struct sk_buff *skb, struct net_device *dev)
 		hrtimer_start(&rq->napi_timer, us_to_ktime(5), HRTIMER_MODE_REL);
 
 	rcu_read_unlock();
-	dev_dstats_tx_add(dev, skb->len);
+	dev_dstats_tx_add(dev, len);
 	return NETDEV_TX_OK;
 
 out_drop_free:
-- 
2.49.0