From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id AB449207DE2; Wed, 19 Mar 2025 12:39:28 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1742387968; cv=none; b=f/SEitQ+Xv5udFMUxhD56+yiWVtPFQhBSy7lSGSctHhlx6XbJijnzOZvjeQ4LoJxm7aH9Md3HlObemU1zDNPilSvBGBsWqwXOnzS2/PX2EuWtQGUKuuYZ2vp4dLx7NN08wIFq4dhwC+z0xUt5rjLjaGj3ex6Lcfqy+wjVrUe8Y0= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1742387968; c=relaxed/simple; bh=+d6fawMch0I0q+4BQrYh7pBFqbseuDAWGqC2kSBQAdo=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=P4A5H9S9bNroLHN1GDVJbVJOlREp9+Cvk74WpUvEtN5pf+tetbY9DDNO0rjK9J/djjh6A5d+X8JBWQUl3d2t4gCJptv8chS1M+HveqrG6uL8REZJ1hmLVCTluOw3ZZqlLUEMfS4y2vJfzg3S3lIX7jmGvrbiO+s/aEr0Bb7J0ik= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=NE0nUbDm; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="NE0nUbDm" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 82028C4CEE9; Wed, 19 Mar 2025 12:39:26 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1742387968; bh=+d6fawMch0I0q+4BQrYh7pBFqbseuDAWGqC2kSBQAdo=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=NE0nUbDmBLZYYLcH/13NBkf1wuPc7SAURDVHx//Xbham/L0YjcI0+9IfKjs2JcTel EDJsCu5fdmTBqZB4H7PQgVRMeBjC/VrOXKAxH3IxHrEtLOQZG7je6oaS2xxFMjSpir 37AtTTOx/aUumccx6RoEWNOWaTmJjJu1dI01hypXPB5c++wjqtOmLeD88QYn7WF/LP eR4O9ye4GQOxSz350i9HXokoS5Yjw6Bw1T7T/hpPz1fqdGhh5H//NvH3SE/5zaPwsI mSmdatwQTQSgiaE114pwDNsaa5M8FPGBJum3oEinJc7aRwx88dyLh9T1PdP8G7r3/k IYxjxPV5ZuHOA== Date: Wed, 19 Mar 2025 12:39:24 +0000 From: Simon Horman To: Dan Carpenter Cc: "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , netdev@vger.kernel.org, linux-kernel@vger.kernel.org, kernel-janitors@vger.kernel.org Subject: Re: [PATCH net] net: atm: fix use after free in lec_send() Message-ID: <20250319123924.GD280585@kernel.org> References: Precedence: bulk X-Mailing-List: netdev@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: On Fri, Mar 14, 2025 at 01:10:57PM +0300, Dan Carpenter wrote: > The ->send() operation frees skb so save the length before calling > ->send() to avoid a use after free. > > Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") > Signed-off-by: Dan Carpenter Reviewed-by: Simon Horman