Received: by 2002:ad5:474a:0:0:0:0:0 with SMTP id i10csp1519910imu; Wed, 28 Nov 2018 10:43:08 -0800 (PST) X-Google-Smtp-Source: AFSGD/V+y8W/aemzJ44qcjWNgzNVuMQogF+0yr9xmwbWuFubRNoh+xVKBF+FESK+PgOO5VHw/fE5 X-Received: by 2002:a63:561b:: with SMTP id k27mr34237059pgb.271.1543430588223; Wed, 28 Nov 2018 10:43:08 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1543430588; cv=none; d=google.com; s=arc-20160816; b=ba4W4MQdg3yBrtMm5DKzmesqFllEF4YUPCtAmeM2rYbXHGxwbTcN5CaTD83XBqOSSX PN+FsyvNPi708Pbd3TtXA1ifI06IgtKLXG9KKDyEzdlsMR32XzUhlxi+uIolsk8J8NKs RcvrxoItiQLJ12+bkw0bp98hoh2suxyVIPgDkXAhd/Nx06jP71wLB/d2ndSepVNJQqvP 5New4WLJdtSKuTG4iwYpsBHip1sXzImuq/QICBFJV04Gi8+pMo6n8mYcyiY1qCCAOP2k PbuSV5MgUfxp0BqFJ8Rt6YhWc6b0S9UQ6sRsdRgco+z6sROboL2zWniyqUgPi8o9KPAz gtcQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :references:in-reply-to:from:subject:cc:to:message-id:date; bh=58Hq+W6otGzw9wZBe5aQtFR/lJRzZyCxIHgwcbGo8XE=; b=ZsNe7WYQdJoKCcdJuesRJnb6/vLVh33pHdHo/fumgXbgQlL8PyEorGu7V+iwFs7wqs 2WfTapd6mTs2hQVDyJb4vBxMcbO5iFj+tOH3ObfZ2s1UyQLAUd9kinTJWw8Xc1IOxS8M gg43zXX6Di4UQJDG4eN4MxK3XRK6nz/QA7jd25oNusy0sxu4xRv+3mM+PU6ZFoMLvCIV pRiSYPqMer82Dm0tk1ZPpNr0LYBAgP3JesGoTzcZNRttBirBwRomo/58KJR+OxwnwpKf lVp3yDotRYIdXGGRmOVTEUkkNsrLfGwNQrN5sOeaWzGnXVJlj3OJxMgfDOZe+g2cREZq SVHA== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id t184si8842333pfb.22.2018.11.28.10.42.37; Wed, 28 Nov 2018 10:43:08 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727047AbeK2Fog (ORCPT + 99 others); Thu, 29 Nov 2018 00:44:36 -0500 Received: from shards.monkeyblade.net ([23.128.96.9]:36086 "EHLO shards.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1725760AbeK2Fog (ORCPT ); Thu, 29 Nov 2018 00:44:36 -0500 Received: from localhost (unknown [IPv6:2601:601:9f80:35cd::bf5]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (Client did not present a certificate) (Authenticated sender: davem-davemloft) by shards.monkeyblade.net (Postfix) with ESMTPSA id DD99614E0B2C6; Wed, 28 Nov 2018 10:42:00 -0800 (PST) Date: Wed, 28 Nov 2018 10:41:58 -0800 (PST) Message-Id: <20181128.104158.314372136288891394.davem@davemloft.net> To: bianpan2016@163.com Cc: netdev@vger.kernel.org, linux-kernel@vger.kernel.org, alexandre.bounine@idt.com Subject: Re: [PATCH] rapidio/rionet: do not free skb before reading its length From: David Miller In-Reply-To: <1543387999-115433-1-git-send-email-bianpan2016@163.com> References: <1543387999-115433-1-git-send-email-bianpan2016@163.com> X-Mailer: Mew version 6.8 on Emacs 26.1 Mime-Version: 1.0 Content-Type: Text/Plain; charset=us-ascii Content-Transfer-Encoding: 7bit X-Greylist: Sender succeeded SMTP AUTH, not delayed by milter-greylist-4.5.12 (shards.monkeyblade.net [149.20.54.216]); Wed, 28 Nov 2018 10:42:01 -0800 (PST) Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Pan Bian Date: Wed, 28 Nov 2018 14:53:19 +0800 > skb is freed via dev_kfree_skb_any, however, skb->len is read then. This > may result in a use-after-free bug. > > Fixes: e6161d64263 ("rapidio/rionet: rework driver initialization and removal") > Signed-off-by: Pan Bian Applied and queued up for -stable.