net: atm: fix use after free in lec_send()

Dan Carpenter · Paolo Abeni · commit f3009d0d6ab7 · 2025-03-20T10:45:29.000+01:00
The ->send() operation frees skb so save the length before calling ->send() to avoid a use after free. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/c751531d-4af4-42fe-affe-6104b34b791d@stanley.mountain Signed-off-by: Paolo Abeni <pabeni@redhat.com>
diff --git a/net/atm/lec.c b/net/atm/lec.c
@@ -181,6 +181,7 @@ static void
 lec_send(struct atm_vcc *vcc, struct sk_buff *skb)
 {
 	struct net_device *dev = skb->dev;
+	unsigned int len = skb->len;
 
 	ATM_SKB(skb)->vcc = vcc;
 	atm_account_tx(vcc, skb);
@@ -191,7 +192,7 @@ lec_send(struct atm_vcc *vcc, struct sk_buff *skb)
 	}
 
 	dev->stats.tx_packets++;
-	dev->stats.tx_bytes += skb->len;
+	dev->stats.tx_bytes += len;
 }
 
 static void lec_tx_timeout(struct net_device *dev, unsigned int txqueue)

Original file line number	Diff line number	Diff line change
`@@ -181,6 +181,7 @@ static void`
`181`	`181`	`lec_send(struct atm_vcc vcc, struct sk_buff skb)`
`182`	`182`	`{`
`183`	`183`	`struct net_device *dev = skb->dev;`
	`184`	`+ unsigned int len = skb->len;`
`184`	`185`
`185`	`186`	`ATM_SKB(skb)->vcc = vcc;`
`186`	`187`	`atm_account_tx(vcc, skb);`
`@@ -191,7 +192,7 @@ lec_send(struct atm_vcc vcc, struct sk_buff skb)`
`191`	`192`	`}`
`192`	`193`
`193`	`194`	`dev->stats.tx_packets++;`
`194`		`- dev->stats.tx_bytes += skb->len;`
	`195`	`+ dev->stats.tx_bytes += len;`
`195`	`196`	`}`
`196`	`197`
`197`	`198`	`static void lec_tx_timeout(struct net_device *dev, unsigned int txqueue)`