From: Matt Johnston <matt@codeconstruct.com.au>
Date: Fri, 25 Feb 2022 05:39:37 +0000 (+0800)
Subject: mctp i2c: Fix potential use-after-free
X-Git-Tag: xarray-5.18a~224^2~249^2~1
X-Git-Url: https://www.infradead.org/git/?a=commitdiff_plain;h=06bf1ce69d55729dc132d423d626398254fedc58;p=users%2Fwilly%2Fxarray.git

mctp i2c: Fix potential use-after-free

The skb is handed off to netif_rx() which may free it.
Found by Smatch.

Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Matt Johnston <matt@codeconstruct.com.au>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
---

diff --git a/drivers/net/mctp/mctp-i2c.c b/drivers/net/mctp/mctp-i2c.c
index 365c3dfd4034..470682c88d7e 100644
--- a/drivers/net/mctp/mctp-i2c.c
+++ b/drivers/net/mctp/mctp-i2c.c
@@ -338,7 +338,7 @@ static int mctp_i2c_recv(struct mctp_i2c_dev *midev)
 
 	if (status == NET_RX_SUCCESS) {
 		ndev->stats.rx_packets++;
-		ndev->stats.rx_bytes += skb->len;
+		ndev->stats.rx_bytes += recvlen;
 	} else {
 		ndev->stats.rx_dropped++;
 	}