e100: Fix possible use after free in e100_xmit_prepare
stable inclusion from stable-v5.10.158 commit b775f37d943966f6f77dca402f5a9dedce502c25 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I7NTXH Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=b775f37d943966f6f77dca402f5a9dedce502c25 -------------------------------- [ Upstream commit 45605c75 ] In e100_xmit_prepare(), if we can't map the skb, then return -ENOMEM, so e100_xmit_frame() will return NETDEV_TX_BUSY and the upper layer will resend the skb. But the skb is already freed, which will cause UAF bug when the upper layer resends the skb. Remove the harmful free. Fixes: 5e5d4942 ("e100: Release skb when DMA mapping is failed in e100_xmit_prepare") Signed-off-by: NWang Hai <wanghai38@huawei.com> Reviewed-by: NAlexander Duyck <alexanderduyck@fb.com> Signed-off-by: NTony Nguyen <anthony.l.nguyen@intel.com> Signed-off-by: NSasha Levin <sashal@kernel.org> Signed-off-by: Nsanglipeng <sanglipeng1@jd.com>
Showing
想要评论请 注册 或 登录