diff options
| author | Jakub Kicinski <kuba@kernel.org> | 2025-06-20 10:40:07 -0700 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2025-06-22 18:50:23 +0100 |
| commit | 5e95c0a3a55aea490420bd6994805edb050cc86b (patch) | |
| tree | e27bbc40135d498ba0e8bdf8f99fd145c4f36582 /drivers/net/netdevsim | |
| parent | 14966a8df77e2dffdf765b56abe194aa6b0da325 (diff) | |
netdevsim: fix UaF when counting Tx stats
skb may be freed as soon as we put it on the rx queue.
Use the len variable like the code did prior to the conversion.
Fixes: f9e2511d80c2 ("netdevsim: migrate to dstats stats collection")
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Acked-by: David S. Miller <davem@davemloft.net>
Reviewed-by: Breno Leitao <leitao@debian.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers/net/netdevsim')
| -rw-r--r-- | drivers/net/netdevsim/netdev.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/net/netdevsim/netdev.c b/drivers/net/netdevsim/netdev.c index 7f2809be5d48..e36d3e846c2d 100644 --- a/drivers/net/netdevsim/netdev.c +++ b/drivers/net/netdevsim/netdev.c @@ -93,7 +93,7 @@ static netdev_tx_t nsim_start_xmit(struct sk_buff *skb, struct net_device *dev) hrtimer_start(&rq->napi_timer, us_to_ktime(5), HRTIMER_MODE_REL); rcu_read_unlock(); - dev_dstats_tx_add(dev, skb->len); + dev_dstats_tx_add(dev, len); return NETDEV_TX_OK; out_drop_free: |