diff options
| author | David Ahern <dsa@cumulusnetworks.com> | 2017-03-22 11:30:30 +0000 |
|---|---|---|
| committer | android-build-merger <android-build-merger@google.com> | 2017-03-22 11:30:30 +0000 |
| commit | 0bf865e8b08185e4d7a5106d01715eeac6488e6e (patch) | |
| tree | 898c7879f747a8f7b32f1db67e5c6ae619f0e67a /drivers/net | |
| parent | f0a80cb8a7f23e8d1d1cf79480ee93d056a0580b (diff) | |
| parent | e671f1cc588f380b17e1c0ce38c7c712d13dfe93 (diff) | |
vrf: Fix use-after-free in vrf_xmit
am: e671f1cc58
Change-Id: I9252af147439040890edc2f612d4868806c2324a
Diffstat (limited to 'drivers/net')
| -rw-r--r-- | drivers/net/vrf.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/net/vrf.c b/drivers/net/vrf.c index d6b619667f1a..349aecbc210a 100644 --- a/drivers/net/vrf.c +++ b/drivers/net/vrf.c @@ -345,6 +345,7 @@ static netdev_tx_t is_ip_tx_frame(struct sk_buff *skb, struct net_device *dev) static netdev_tx_t vrf_xmit(struct sk_buff *skb, struct net_device *dev) { + int len = skb->len; netdev_tx_t ret = is_ip_tx_frame(skb, dev); if (likely(ret == NET_XMIT_SUCCESS || ret == NET_XMIT_CN)) { @@ -352,7 +353,7 @@ static netdev_tx_t vrf_xmit(struct sk_buff *skb, struct net_device *dev) u64_stats_update_begin(&dstats->syncp); dstats->tx_pkts++; - dstats->tx_bytes += skb->len; + dstats->tx_bytes += len; u64_stats_update_end(&dstats->syncp); } else { this_cpu_inc(dev->dstats->tx_drps); |