macsec: avoid use-after-free in macsec_handle_frame() (c7cc9200) · Commits · 戴 / test

De-referencing skb after call to gro_cells_receive() is not allowed. We need to fetch skb->len earlier. Fixes: ("macsec: enable GRO and RPS on macsec devices") Signed-off-by:

Eric Dumazet <edumazet@google.com> Cc: Paolo Abeni <pabeni@redhat.com> Acked-by:

Paolo Abeni <pabeni@redhat.com> Signed-off-by:

Jakub Kicinski <kuba@kernel.org>

drivers/net/macsec.c

+3 −1

Original line number	Diff line number	Diff line
		@@ -1077,6 +1077,7 @@ static rx_handler_result_t macsec_handle_frame(struct sk_buff **pskb)
		struct macsec_rx_sa *rx_sa;
		struct macsec_rxh_data *rxd;
		struct macsec_dev *macsec;
		unsigned int len;
		sci_t sci;
		u32 hdr_pn;
		bool cbit;
		@@ -1232,9 +1233,10 @@ deliver:
		macsec_rxsc_put(rx_sc);

		skb_orphan(skb);
		len = skb->len;
		ret = gro_cells_receive(&macsec->gro_cells, skb);
		if (ret == NET_RX_SUCCESS)
		count_rx(dev, skb->len);
		count_rx(dev, len);
		else
		macsec->secy.netdev->stats.rx_dropped++;

Admin message