On Wed, Nov 28, 2018 at 10:49:31AM -0800, David Miller wrote:
> From: Pan Bian
> Date: Wed, 28 Nov 2018 16:09:45 +0800
>
> If either of these two cases are executed, it means that it must be
> the case that:
>
> !last || context_next
>
> is FALSE, therefore the conditional in the tail cod
From: Pan Bian
Date: Wed, 28 Nov 2018 16:09:45 +0800
> @@ -2754,6 +2754,7 @@ static int xgbe_rx_poll(struct xgbe_channel *channel,
> int budget)
> netif_err(pdata, rx_err, netdev,
> "error in received packet\n");
>
The buffer skb is freed via dev_kfree_skb in a loop. skb may be used
again in the next iteration, resulting in a use-after-free bug. To fix
this, the patch set skb to NULL after dev_kfree_skb(skb).
Signed-off-by: Pan Bian
---
drivers/net/ethernet/amd/xgbe/xgbe-drv.c | 2 ++
1 file changed, 2 ins
