Commit 086ddc5e authored by Tho Vu's avatar Tho Vu Committed by Greg Kroah-Hartman

ravb: Fix use-after-free ravb_tstamp_skb

[ Upstream commit cfef46d6 ]

When a Tx timestamp is requested, a pointer to the skb is stored in the
ravb_tstamp_skb struct. This was done without an skb_get. There exists
the possibility that the skb could be freed by ravb_tx_free (when
ravb_tx_free is called from ravb_start_xmit) before the timestamp was
processed, leading to a use-after-free bug.

Use skb_get when filling a ravb_tstamp_skb struct, and add appropriate
frees/consumes when a ravb_tstamp_skb struct is freed.

Fixes: c156633f ("Renesas Ethernet AVB driver proper")
Signed-off-by: default avatarTho Vu <>
Signed-off-by: default avatarKazuya Mizuguchi <>
Signed-off-by: default avatarSimon Horman <>
Signed-off-by: default avatarDavid S. Miller <>
Signed-off-by: default avatarSasha Levin <>
parent 37f12b89
// SPDX-License-Identifier: GPL-2.0
/* Renesas Ethernet AVB device driver
* Copyright (C) 2014-2015 Renesas Electronics Corporation
* Copyright (C) 2014-2019 Renesas Electronics Corporation
* Copyright (C) 2015 Renesas Solutions Corp.
* Copyright (C) 2015-2016 Cogent Embedded, Inc. <>
......@@ -513,7 +513,10 @@ static void ravb_get_tx_tstamp(struct net_device *ndev)
if (tag == tfa_tag) {
skb_tstamp_tx(skb, &shhwtstamps);
} else {
ravb_modify(ndev, TCCR, TCCR_TFR, TCCR_TFR);
......@@ -1564,7 +1567,7 @@ static netdev_tx_t ravb_start_xmit(struct sk_buff *skb, struct net_device *ndev)
goto unmap;
ts_skb->skb = skb;
ts_skb->skb = skb_get(skb);
ts_skb->tag = priv->ts_skb_tag++;
priv->ts_skb_tag &= 0x3ff;
list_add_tail(&ts_skb->list, &priv->ts_skb_list);
......@@ -1693,6 +1696,7 @@ static int ravb_close(struct net_device *ndev)
/* Clear the timestamp list */
list_for_each_entry_safe(ts_skb, ts_skb2, &priv->ts_skb_list, list) {
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment