Commit a9a18e8f authored by Dan Carpenter's avatar Dan Carpenter Committed by David S. Miller
Browse files

atm: idt77252: prevent use after free in dequeue_rx() 



We can't dereference "skb" after calling vcc->push() because the skb
is released.

Fixes: 1da177e4 ("Linux-2.6.12-rc2")
Signed-off-by: default avatarDan Carpenter <dan.carpenter@linaro.org>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 484caf20

drivers/atm/idt77252.c

+5 −4
Original line number Diff line number Diff line
@@ -1118,8 +1118,8 @@ dequeue_rx(struct idt77252_dev *card, struct rsq_entry *rsqe) 
	rpp->len += skb->len;



	if (stat & SAR_RSQE_EPDU) {

		unsigned int len, truesize;

		unsigned char *l1l2;

		unsigned int len;



		l1l2 = (unsigned char *) ((unsigned long) skb->data + skb->len - 6);
@@ -1189,14 +1189,15 @@ dequeue_rx(struct idt77252_dev *card, struct rsq_entry *rsqe) 
		ATM_SKB(skb)->vcc = vcc;

		__net_timestamp(skb);



		truesize = skb->truesize;

		vcc->push(vcc, skb);

		atomic_inc(&vcc->stats->rx);



		if (skb->truesize > SAR_FB_SIZE_3)

		if (truesize > SAR_FB_SIZE_3)

			add_rx_skb(card, 3, SAR_FB_SIZE_3, 1);

		else if (skb->truesize > SAR_FB_SIZE_2)

		else if (truesize > SAR_FB_SIZE_2)

			add_rx_skb(card, 2, SAR_FB_SIZE_2, 1);

		else if (skb->truesize > SAR_FB_SIZE_1)

		else if (truesize > SAR_FB_SIZE_1)

			add_rx_skb(card, 1, SAR_FB_SIZE_1, 1);

		else

			add_rx_skb(card, 0, SAR_FB_SIZE_0, 1);