diff options
| author | Eric Dumazet <dada1@cosmosbay.com> | 2009-05-19 00:12:31 +0200 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2009-05-19 00:12:31 +0200 |
| commit | c0f84d0d4be3f7d818b4ffb04d27f9bae64397f0 (patch) | |
| tree | e36a3f3e2d5cdbc9dfdbd2c5dd4857d93d8776b9 | |
| parent | tcp: fix MSG_PEEK race check (diff) | |
| download | linux-c0f84d0d4be3f7d818b4ffb04d27f9bae64397f0.tar.xz linux-c0f84d0d4be3f7d818b4ffb04d27f9bae64397f0.zip | |
sch_teql: should not dereference skb after ndo_start_xmit()
It is illegal to dereference a skb after a successful ndo_start_xmit()
call. We must store skb length in a local variable instead.
Bug was introduced in 2.6.27 by commit 0abf77e55a2459aa9905be4b226e4729d5b4f0cb
(net_sched: Add accessor function for packet length for qdiscs)
Signed-off-by: Eric Dumazet <dada1@cosmosbay.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
| -rw-r--r-- | net/sched/sch_teql.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/net/sched/sch_teql.c b/net/sched/sch_teql.c index ec697cebb63b..3b6418297231 100644 --- a/net/sched/sch_teql.c +++ b/net/sched/sch_teql.c @@ -303,6 +303,8 @@ restart: switch (teql_resolve(skb, skb_res, slave)) { case 0: if (__netif_tx_trylock(slave_txq)) { + unsigned int length = qdisc_pkt_len(skb); + if (!netif_tx_queue_stopped(slave_txq) && !netif_tx_queue_frozen(slave_txq) && slave_ops->ndo_start_xmit(skb, slave) == 0) { @@ -310,8 +312,7 @@ restart: master->slaves = NEXT_SLAVE(q); netif_wake_queue(dev); master->stats.tx_packets++; - master->stats.tx_bytes += - qdisc_pkt_len(skb); + master->stats.tx_bytes += length; return 0; } __netif_tx_unlock(slave_txq); |