* [PATCH net-XXX] mISDN: Fix a use after free in hfcmulti_tx()
@ 2024-07-24 16:08 Dan Carpenter
2024-07-24 18:53 ` Simon Horman
2024-07-25 15:19 ` patchwork-bot+netdevbpf
0 siblings, 2 replies; 4+ messages in thread
From: Dan Carpenter @ 2024-07-24 16:08 UTC (permalink / raw)
To: Karsten Keil
Cc: Karsten Keil, Jeff Johnson, Jakub Kicinski, netdev,
kernel-janitors
Don't dereference *sp after calling dev_kfree_skb(*sp).
Fixes: af69fb3a8ffa ("Add mISDN HFC multiport driver")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
---
drivers/isdn/hardware/mISDN/hfcmulti.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/drivers/isdn/hardware/mISDN/hfcmulti.c b/drivers/isdn/hardware/mISDN/hfcmulti.c
index 0d2928d8aeae..e5a483fd9ad8 100644
--- a/drivers/isdn/hardware/mISDN/hfcmulti.c
+++ b/drivers/isdn/hardware/mISDN/hfcmulti.c
@@ -1901,7 +1901,7 @@ hfcmulti_dtmf(struct hfc_multi *hc)
static void
hfcmulti_tx(struct hfc_multi *hc, int ch)
{
- int i, ii, temp, len = 0;
+ int i, ii, temp, tmp_len, len = 0;
int Zspace, z1, z2; /* must be int for calculation */
int Fspace, f1, f2;
u_char *d;
@@ -2122,14 +2122,15 @@ hfcmulti_tx(struct hfc_multi *hc, int ch)
HFC_wait_nodebug(hc);
}
+ tmp_len = (*sp)->len;
dev_kfree_skb(*sp);
/* check for next frame */
if (bch && get_next_bframe(bch)) {
- len = (*sp)->len;
+ len = tmp_len;
goto next_frame;
}
if (dch && get_next_dframe(dch)) {
- len = (*sp)->len;
+ len = tmp_len;
goto next_frame;
}
--
2.43.0
^ permalink raw reply related [flat|nested] 4+ messages in thread* Re: [PATCH net-XXX] mISDN: Fix a use after free in hfcmulti_tx()
2024-07-24 16:08 [PATCH net-XXX] mISDN: Fix a use after free in hfcmulti_tx() Dan Carpenter
@ 2024-07-24 18:53 ` Simon Horman
2024-07-24 23:13 ` Dan Carpenter
2024-07-25 15:19 ` patchwork-bot+netdevbpf
1 sibling, 1 reply; 4+ messages in thread
From: Simon Horman @ 2024-07-24 18:53 UTC (permalink / raw)
To: Dan Carpenter
Cc: Karsten Keil, Karsten Keil, Jeff Johnson, Jakub Kicinski, netdev,
kernel-janitors
On Wed, Jul 24, 2024 at 11:08:18AM -0500, Dan Carpenter wrote:
> Don't dereference *sp after calling dev_kfree_skb(*sp).
>
> Fixes: af69fb3a8ffa ("Add mISDN HFC multiport driver")
> Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
> ---
> drivers/isdn/hardware/mISDN/hfcmulti.c | 7 ++++---
> 1 file changed, 4 insertions(+), 3 deletions(-)
I guess that this is net material.
Reviewed-by: Simon Horman <horms@kernel.org>
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [PATCH net-XXX] mISDN: Fix a use after free in hfcmulti_tx()
2024-07-24 18:53 ` Simon Horman
@ 2024-07-24 23:13 ` Dan Carpenter
0 siblings, 0 replies; 4+ messages in thread
From: Dan Carpenter @ 2024-07-24 23:13 UTC (permalink / raw)
To: Simon Horman
Cc: Karsten Keil, Karsten Keil, Jeff Johnson, Jakub Kicinski, netdev,
kernel-janitors
On Wed, Jul 24, 2024 at 07:53:02PM +0100, Simon Horman wrote:
> On Wed, Jul 24, 2024 at 11:08:18AM -0500, Dan Carpenter wrote:
> > Don't dereference *sp after calling dev_kfree_skb(*sp).
> >
> > Fixes: af69fb3a8ffa ("Add mISDN HFC multiport driver")
> > Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
> > ---
> > drivers/isdn/hardware/mISDN/hfcmulti.c | 7 ++++---
> > 1 file changed, 4 insertions(+), 3 deletions(-)
>
> I guess that this is net material.
Yeah. I verified that it applied to net but forgot to update the
subject. :/
regards,
dan carpenter
>
> Reviewed-by: Simon Horman <horms@kernel.org>
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH net-XXX] mISDN: Fix a use after free in hfcmulti_tx()
2024-07-24 16:08 [PATCH net-XXX] mISDN: Fix a use after free in hfcmulti_tx() Dan Carpenter
2024-07-24 18:53 ` Simon Horman
@ 2024-07-25 15:19 ` patchwork-bot+netdevbpf
1 sibling, 0 replies; 4+ messages in thread
From: patchwork-bot+netdevbpf @ 2024-07-25 15:19 UTC (permalink / raw)
To: Dan Carpenter; +Cc: kkeil, isdn, quic_jjohnson, kuba, netdev, kernel-janitors
Hello:
This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:
On Wed, 24 Jul 2024 11:08:18 -0500 you wrote:
> Don't dereference *sp after calling dev_kfree_skb(*sp).
>
> Fixes: af69fb3a8ffa ("Add mISDN HFC multiport driver")
> Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
> ---
> drivers/isdn/hardware/mISDN/hfcmulti.c | 7 ++++---
> 1 file changed, 4 insertions(+), 3 deletions(-)
Here is the summary with links:
- [net-XXX] mISDN: Fix a use after free in hfcmulti_tx()
https://git.kernel.org/netdev/net/c/61ab751451f5
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2024-07-25 15:19 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2024-07-24 16:08 [PATCH net-XXX] mISDN: Fix a use after free in hfcmulti_tx() Dan Carpenter
2024-07-24 18:53 ` Simon Horman
2024-07-24 23:13 ` Dan Carpenter
2024-07-25 15:19 ` patchwork-bot+netdevbpf
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).