From: Simon Horman <[email protected]> Date: Fri, 16 Aug 2019 17:17:02 +0200
> From: Tho Vu <[email protected]> > > When a Tx timestamp is requested, a pointer to the skb is stored in the > ravb_tstamp_skb struct. This was done without an skb_get. There exists > the possibility that the skb could be freed by ravb_tx_free (when > ravb_tx_free is called from ravb_start_xmit) before the timestamp was > processed, leading to a use-after-free bug. > > Use skb_get when filling a ravb_tstamp_skb struct, and add appropriate > frees/consumes when a ravb_tstamp_skb struct is freed. > > Fixes: c156633f1353 ("Renesas Ethernet AVB driver proper") > Signed-off-by: Tho Vu <[email protected]> > Signed-off-by: Kazuya Mizuguchi <[email protected]> > Signed-off-by: Simon Horman <[email protected]> > --- > As this is an old bug I am submitting a fix against net-next rather than > net: I do not see any urgency here. I am however, happy for it to be > applied against net instead. Applied to 'net', thanks Simon.
