* [PATCH] net: ethernet: lantiq_etop: fix double free in detach
@ 2024-07-07 14:10 Aleksander Jan Bajkowski
2024-07-07 14:43 ` Andrew Lunn
0 siblings, 1 reply; 2+ messages in thread
From: Aleksander Jan Bajkowski @ 2024-07-07 14:10 UTC (permalink / raw)
To: davem, edumazet, kuba, pabeni, jacob.e.keller, u.kleine-koenig,
olek2, netdev, linux-kernel
Cc: Joe Perches
The number of the currently released descriptor is never incremented
which results in the same skb being released multiple times.
Reported-by: Joe Perches <joe@perches.com>
Closes: https://lore.kernel.org/all/fc1bf93d92bb5b2f99c6c62745507cc22f3a7b2d.camel@perches.com/
Signed-off-by: Aleksander Jan Bajkowski <olek2@wp.pl>
---
drivers/net/ethernet/lantiq_etop.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
diff --git a/drivers/net/ethernet/lantiq_etop.c b/drivers/net/ethernet/lantiq_etop.c
index 5352fee62d2b..6027e5a179b4 100644
--- a/drivers/net/ethernet/lantiq_etop.c
+++ b/drivers/net/ethernet/lantiq_etop.c
@@ -217,9 +217,7 @@ ltq_etop_free_channel(struct net_device *dev, struct ltq_etop_chan *ch)
if (ch->dma.irq)
free_irq(ch->dma.irq, priv);
if (IS_RX(ch->idx)) {
- int desc;
-
- for (desc = 0; desc < LTQ_DESC_NUM; desc++)
+ for (ch->dma.desc = 0; ch->dma.desc < LTQ_DESC_NUM; ch->dma.desc++)
dev_kfree_skb_any(ch->skb[ch->dma.desc]);
}
}
--
2.39.2
^ permalink raw reply related [flat|nested] 2+ messages in thread* Re: [PATCH] net: ethernet: lantiq_etop: fix double free in detach
2024-07-07 14:10 [PATCH] net: ethernet: lantiq_etop: fix double free in detach Aleksander Jan Bajkowski
@ 2024-07-07 14:43 ` Andrew Lunn
0 siblings, 0 replies; 2+ messages in thread
From: Andrew Lunn @ 2024-07-07 14:43 UTC (permalink / raw)
To: Aleksander Jan Bajkowski
Cc: davem, edumazet, kuba, pabeni, jacob.e.keller, u.kleine-koenig,
netdev, linux-kernel, Joe Perches
On Sun, Jul 07, 2024 at 04:10:37PM +0200, Aleksander Jan Bajkowski wrote:
> The number of the currently released descriptor is never incremented
> which results in the same skb being released multiple times.
>
> Reported-by: Joe Perches <joe@perches.com>
> Closes: https://lore.kernel.org/all/fc1bf93d92bb5b2f99c6c62745507cc22f3a7b2d.camel@perches.com/
> Signed-off-by: Aleksander Jan Bajkowski <olek2@wp.pl>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Andrew
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2024-07-07 14:43 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2024-07-07 14:10 [PATCH] net: ethernet: lantiq_etop: fix double free in detach Aleksander Jan Bajkowski
2024-07-07 14:43 ` Andrew Lunn
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox