Tho Vu cfef46d692 ravb: Fix use-after-free ravb_tstamp_skb ... When a Tx timestamp is requested, a pointer to the skb is stored in the ravb_tstamp_skb struct. This was done without an skb_get. There exists the possibility that the skb could be freed by ravb_tx_free (when ravb_tx_free is called from ravb_start_xmit) before the timestamp was processed, leading to a use-after-free bug. Use skb_get when filling a ravb_tstamp_skb struct, and add appropriate frees/consumes when a ravb_tstamp_skb struct is freed. Fixes: c156633f13 ("Renesas Ethernet AVB driver proper") Signed-off-by: Tho Vu <tho.vu.wh@rvc.renesas.com> Signed-off-by: Kazuya Mizuguchi <kazuya.mizuguchi.ks@renesas.com> Signed-off-by: Simon Horman <horms+renesas@verge.net.au> Signed-off-by: David S. Miller <davem@davemloft.net>		2019-08-18 14:19:14 -07:00
..
Kconfig	ethernet: renesas: convert to SPDX identifiers	2018-09-10 10:11:53 -07:00
Makefile	ethernet: renesas: convert to SPDX identifiers	2018-09-10 10:11:53 -07:00
ravb_main.c	ravb: Fix use-after-free ravb_tstamp_skb	2019-08-18 14:19:14 -07:00
ravb_ptp.c	drivers: Remove explicit invocations of mmiowb()	2019-04-08 12:01:02 +01:00
ravb.h	ravb: Clean up duplex handling	2018-11-23 11:14:47 -08:00
sh_eth.c	net: sh_eth: fix mdio access in sh_eth_close() for R-Car Gen2 and RZ/A1 SoCs	2019-05-29 13:24:54 -07:00
sh_eth.h	sh_eth: RX checksum offload support	2019-02-04 13:31:00 -08:00