macsec: avoid use-after-free in macsec_handle_frame()
authorEric Dumazet <edumazet@google.com>
Wed, 7 Oct 2020 08:42:46 +0000 (01:42 -0700)
committerJakub Kicinski <kuba@kernel.org>
Thu, 8 Oct 2020 19:21:08 +0000 (12:21 -0700)
commitc7cc9200e9b4a2ac172e990ef1975cd42975dad6
treed086a5359881325cddb35adc80a654e90afa8618
parent47dda78671a3d5cee3fb2229e37997d2ac8a3b54
macsec: avoid use-after-free in macsec_handle_frame()

De-referencing skb after call to gro_cells_receive() is not allowed.
We need to fetch skb->len earlier.

Fixes: 5491e7c6b1a9 ("macsec: enable GRO and RPS on macsec devices")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Paolo Abeni <pabeni@redhat.com>
Acked-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
drivers/net/macsec.c