• Dean Jenkins's avatar
    asix: Add rx->ax_skb = NULL after usbnet_skb_return() · 22889dbb
    Dean Jenkins authored
    In asix_rx_fixup_internal() there is a risk that rx->ax_skb gets
    reused after passing the Ethernet frame into the network stack via
    usbnet_skb_return().
    
    The risks include:
    
    a) asynchronously freeing rx->ax_skb after passing the netdev buffer
       to the NAPI layer which might corrupt the backlog queue.
    
    b) erroneously reusing rx->ax_skb such as calling skb_put_data() multiple
       times which causes writing off the end of the netdev buffer.
    
    Therefore add a defensive rx->ax_skb = NULL after usbnet_skb_return()
    so that it is not possible to free rx->ax_skb or to apply
    skb_put_data() too many times.
    Signed-off-by: default avatarDean Jenkins <Dean_Jenkins@mentor.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    22889dbb
asix_common.c 18.9 KB