[PATCH net-XXX] mISDN: Fix a use after free in hfcmulti_tx()

[PATCH net-XXX] mISDN: Fix a use after free in hfcmulti_tx()

[Dan Carpenter]

Don't dereference *sp after calling dev_kfree_skb(*sp).

Fixes: af69fb3a8ffa ("Add mISDN HFC multiport driver")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
---
 drivers/isdn/hardware/mISDN/hfcmulti.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/isdn/hardware/mISDN/hfcmulti.c b/drivers/isdn/hardware/mISDN/hfcmulti.c
index 0d2928d8aeae..e5a483fd9ad8 100644
--- a/drivers/isdn/hardware/mISDN/hfcmulti.c
+++ b/drivers/isdn/hardware/mISDN/hfcmulti.c
@@ -1901,7 +1901,7 @@ hfcmulti_dtmf(struct hfc_multi *hc)
 static void
 hfcmulti_tx(struct hfc_multi *hc, int ch)
 {
-	int i, ii, temp, len = 0;
+	int i, ii, temp, tmp_len, len = 0;
 	int Zspace, z1, z2; /* must be int for calculation */
 	int Fspace, f1, f2;
 	u_char *d;
@@ -2122,14 +2122,15 @@ hfcmulti_tx(struct hfc_multi *hc, int ch)
 		HFC_wait_nodebug(hc);
 	}
 
+	tmp_len = (*sp)->len;
 	dev_kfree_skb(*sp);
 	/* check for next frame */
 	if (bch && get_next_bframe(bch)) {
-		len = (*sp)->len;
+		len = tmp_len;
 		goto next_frame;
 	}
 	if (dch && get_next_dframe(dch)) {
-		len = (*sp)->len;
+		len = tmp_len;
 		goto next_frame;
 	}
 
-- 
2.43.0

Re: [PATCH net-XXX] mISDN: Fix a use after free in hfcmulti_tx()

[Simon Horman]

On Wed, Jul 24, 2024 at 11:08:18AM -0500, Dan Carpenter wrote:
> Don't dereference *sp after calling dev_kfree_skb(*sp).
> 
> Fixes: af69fb3a8ffa ("Add mISDN HFC multiport driver")
> Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
> ---
>  drivers/isdn/hardware/mISDN/hfcmulti.c | 7 ++++---
>  1 file changed, 4 insertions(+), 3 deletions(-)

I guess that this is net material.

Reviewed-by: Simon Horman <horms@kernel.org>

Re: [PATCH net-XXX] mISDN: Fix a use after free in hfcmulti_tx()

[Dan Carpenter]

On Wed, Jul 24, 2024 at 07:53:02PM +0100, Simon Horman wrote:
> On Wed, Jul 24, 2024 at 11:08:18AM -0500, Dan Carpenter wrote:
> > Don't dereference *sp after calling dev_kfree_skb(*sp).
> > 
> > Fixes: af69fb3a8ffa ("Add mISDN HFC multiport driver")
> > Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
> > ---
> >  drivers/isdn/hardware/mISDN/hfcmulti.c | 7 ++++---
> >  1 file changed, 4 insertions(+), 3 deletions(-)
> 
> I guess that this is net material.

Yeah.  I verified that it applied to net but forgot to update the
subject.  :/

regards,
dan carpenter

> 
> Reviewed-by: Simon Horman <horms@kernel.org>

Re: [PATCH net-XXX] mISDN: Fix a use after free in hfcmulti_tx()

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Wed, 24 Jul 2024 11:08:18 -0500 you wrote:
> Don't dereference *sp after calling dev_kfree_skb(*sp).
> 
> Fixes: af69fb3a8ffa ("Add mISDN HFC multiport driver")
> Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
> ---
>  drivers/isdn/hardware/mISDN/hfcmulti.c | 7 ++++---
>  1 file changed, 4 insertions(+), 3 deletions(-)

Here is the summary with links:
  - [net-XXX] mISDN: Fix a use after free in hfcmulti_tx()
    https://git.kernel.org/netdev/net/c/61ab751451f5

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html