From: Simon Horman <horms+rene...@verge.net.au>
Date: Fri, 16 Aug 2019 17:17:02 +0200
> From: Tho Vu <tho.vu...@rvc.renesas.com>
>
> When a Tx timestamp is requested, a pointer to the skb is stored in the
> ravb_tstamp_skb struct. This was done without an skb_get. There exists
> the possibility that the skb could be freed by ravb_tx_free (when
> ravb_tx_free is called from ravb_start_xmit) before the timestamp was
> processed, leading to a use-after-free bug.
>
> Use skb_get when filling a ravb_tstamp_skb struct, and add appropriate
> frees/consumes when a ravb_tstamp_skb struct is freed.
>
> Fixes: c156633f1353 ("Renesas Ethernet AVB driver proper")
> Signed-off-by: Tho Vu <tho.vu...@rvc.renesas.com>
> Signed-off-by: Kazuya Mizuguchi <kazuya.mizuguchi...@renesas.com>
> Signed-off-by: Simon Horman <horms+rene...@verge.net.au>
> ---
> As this is an old bug I am submitting a fix against net-next rather than
> net: I do not see any urgency here. I am however, happy for it to be
> applied against net instead.
Applied to 'net', thanks Simon.
