From ecc0229c0c7d60f6db8b7fc3476fffcc3e284c23 Mon Sep 17 00:00:00 2001 From: Zhang Shurong Date: Mon, 15 Dec 2025 03:31:20 +0000 Subject: [PATCH] firewire: net: fix use after free in fwnet_finish_incoming_packet() mainline inclusion from mainline-v6.17-rc7 commit 3ff256751a2853e1ffaa36958ff933ccc98c6cb5 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICYQPN CVE: CVE-2023-53432 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=3ff256751a2853e1ffaa36958ff933ccc98c6cb5 -------------------------------- The netif_rx() function frees the skb so we can't dereference it to save the skb->len. Signed-off-by: Zhang Shurong Link: https://lore.kernel.org/r/tencent_3B3D24B66ED66A6BB73CC0E63C6A14E45109@qq.com Signed-off-by: Takashi Sakamoto Conflicts: drivers/firewire/net.c [Context differences.] Signed-off-by: Xia Fukun --- drivers/firewire/net.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/drivers/firewire/net.c b/drivers/firewire/net.c index 715e491dfbc3..8504e95ede90 100644 --- a/drivers/firewire/net.c +++ b/drivers/firewire/net.c @@ -489,7 +489,7 @@ static int fwnet_finish_incoming_packet(struct net_device *net, bool is_broadcast, u16 ether_type) { struct fwnet_device *dev; - int status; + int status, len; __be64 guid; switch (ether_type) { @@ -546,13 +546,15 @@ static int fwnet_finish_incoming_packet(struct net_device *net, } skb->protocol = protocol; } + + len = skb->len; status = netif_rx(skb); if (status == NET_RX_DROP) { net->stats.rx_errors++; net->stats.rx_dropped++; } else { net->stats.rx_packets++; - net->stats.rx_bytes += skb->len; + net->stats.rx_bytes += len; } return 0; -- Gitee