atm: idt77252: prevent use after free in dequeue_rx()

We can't dereference "skb" after calling vcc->push() because the skb
is released.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/drivers/atm/idt77252.c b/drivers/atm/idt77252.c
index e7f713cd70d3fd7a413c2568b8dca8f8cc8ba2c4..a876024d8a05f964fb79fb04bd5447b67f28f20c 100644 (file)
--- a/drivers/atm/idt77252.c
+++ b/drivers/atm/idt77252.c
@@ -1118,8 +1118,8 @@ dequeue_rx(struct idt77252_dev *card, struct rsq_entry *rsqe)
        rpp->len += skb->len;
 
        if (stat & SAR_RSQE_EPDU) {
+               unsigned int len, truesize;
                unsigned char *l1l2;
-               unsigned int len;
 
                l1l2 = (unsigned char *) ((unsigned long) skb->data + skb->len - 6);
 
@@ -1189,14 +1189,15 @@ dequeue_rx(struct idt77252_dev *card, struct rsq_entry *rsqe)
                ATM_SKB(skb)->vcc = vcc;
                __net_timestamp(skb);
 
+               truesize = skb->truesize;
                vcc->push(vcc, skb);
                atomic_inc(&vcc->stats->rx);
 
-               if (skb->truesize > SAR_FB_SIZE_3)
+               if (truesize > SAR_FB_SIZE_3)
                        add_rx_skb(card, 3, SAR_FB_SIZE_3, 1);
-               else if (skb->truesize > SAR_FB_SIZE_2)
+               else if (truesize > SAR_FB_SIZE_2)
                        add_rx_skb(card, 2, SAR_FB_SIZE_2, 1);
-               else if (skb->truesize > SAR_FB_SIZE_1)
+               else if (truesize > SAR_FB_SIZE_1)
                        add_rx_skb(card, 1, SAR_FB_SIZE_1, 1);
                else
                        add_rx_skb(card, 0, SAR_FB_SIZE_0, 1);