[PATCH net-next] netdevsim: fix UaF when counting Tx stats

[PATCH net-next] netdevsim: fix UaF when counting Tx stats

[Jakub Kicinski]

skb may be freed as soon as we put it on the rx queue.
Use the len variable like the code did prior to the conversion.

Fixes: f9e2511d80c2 ("netdevsim: migrate to dstats stats collection")
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
---
CC: leitao@debian.org
CC: joe@dama.to
---
 drivers/net/netdevsim/netdev.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/netdevsim/netdev.c b/drivers/net/netdevsim/netdev.c
index 7f2809be5d48..e36d3e846c2d 100644
--- a/drivers/net/netdevsim/netdev.c
+++ b/drivers/net/netdevsim/netdev.c
@@ -93,7 +93,7 @@ static netdev_tx_t nsim_start_xmit(struct sk_buff *skb, struct net_device *dev)
 		hrtimer_start(&rq->napi_timer, us_to_ktime(5), HRTIMER_MODE_REL);
 
 	rcu_read_unlock();
-	dev_dstats_tx_add(dev, skb->len);
+	dev_dstats_tx_add(dev, len);
 	return NETDEV_TX_OK;
 
 out_drop_free:
-- 
2.49.0

Re: [PATCH net-next] netdevsim: fix UaF when counting Tx stats

[David Miller]

From: Jakub Kicinski <kuba@kernel.org>
Date: Fri, 20 Jun 2025 10:40:07 -0700

> skb may be freed as soon as we put it on the rx queue.
> Use the len variable like the code did prior to the conversion.
> 
> Fixes: f9e2511d80c2 ("netdevsim: migrate to dstats stats collection")
> Signed-off-by: Jakub Kicinski <kuba@kernel.org>

Acked-by: David S. Miller <davem@davemloft.net>

Re: [PATCH net-next] netdevsim: fix UaF when counting Tx stats

[Breno Leitao]

On Fri, Jun 20, 2025 at 10:40:07AM -0700, Jakub Kicinski wrote:
> skb may be freed as soon as we put it on the rx queue.
> Use the len variable like the code did prior to the conversion.
> 
> Fixes: f9e2511d80c2 ("netdevsim: migrate to dstats stats collection")
> Signed-off-by: Jakub Kicinski <kuba@kernel.org>

Reviewed-by: Breno Leitao <leitao@debian.org>

Re: [PATCH net-next] netdevsim: fix UaF when counting Tx stats

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net-next.git (main)
by David S. Miller <davem@davemloft.net>:

On Fri, 20 Jun 2025 10:40:07 -0700 you wrote:
> skb may be freed as soon as we put it on the rx queue.
> Use the len variable like the code did prior to the conversion.
> 
> Fixes: f9e2511d80c2 ("netdevsim: migrate to dstats stats collection")
> Signed-off-by: Jakub Kicinski <kuba@kernel.org>
> ---
> CC: leitao@debian.org
> CC: joe@dama.to
> 
> [...]

Here is the summary with links:
  - [net-next] netdevsim: fix UaF when counting Tx stats
    https://git.kernel.org/netdev/net-next/c/5e95c0a3a55a

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html