The skb is delivered to napi_gro_receive() which may free it, after calling this,
dereferencing skb may trigger use-after-free.
Fixes:
|
||
---|---|---|
.. | ||
Kconfig | ||
Makefile | ||
ravb.h | ||
ravb_main.c | ||
ravb_ptp.c | ||
sh_eth.c | ||
sh_eth.h |
The skb is delivered to napi_gro_receive() which may free it, after calling this,
dereferencing skb may trigger use-after-free.
Fixes:
|
||
---|---|---|
.. | ||
Kconfig | ||
Makefile | ||
ravb.h | ||
ravb_main.c | ||
ravb_ptp.c | ||
sh_eth.c | ||
sh_eth.h |