diff options
| author | Eric Dumazet <eric.dumazet@gmail.com> | 2013-12-20 03:10:40 +0100 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2013-12-27 19:00:31 +0100 |
| commit | 37ec274e9713eafc2ba6c4471420f06cb8f68ecf (patch) | |
| tree | 17ed7f410dcac72c1739e26bb01e957d2b8568ed /drivers/net/ethernet/arc | |
| parent | tg3: Expand 4g_overflow_test workaround to skb fragments of any size. (diff) | |
| download | linux-37ec274e9713eafc2ba6c4471420f06cb8f68ecf.tar.xz linux-37ec274e9713eafc2ba6c4471420f06cb8f68ecf.zip | |
arc_emac: fix potential use after free
Signed-off-by: Eric Dumazet <edumazet@google.com>
skb_tx_timestamp(skb) should be called _before_ TX completion
has a chance to trigger, otherwise it is too late and we access
freed memory.
Fixes: e4f2379db6c6 ("ethernet/arc/arc_emac - Add new driver")
From: Eric Dumazet <edumazet@google.com>
Cc: Alexey Brodkin <Alexey.Brodkin@synopsys.com>
Cc: Richard Cochran <richardcochran@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers/net/ethernet/arc')
| -rw-r--r-- | drivers/net/ethernet/arc/emac_main.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/net/ethernet/arc/emac_main.c b/drivers/net/ethernet/arc/emac_main.c index b2ffad1304d2..248baf6273fb 100644 --- a/drivers/net/ethernet/arc/emac_main.c +++ b/drivers/net/ethernet/arc/emac_main.c @@ -565,6 +565,8 @@ static int arc_emac_tx(struct sk_buff *skb, struct net_device *ndev) /* Make sure pointer to data buffer is set */ wmb(); + skb_tx_timestamp(skb); + *info = cpu_to_le32(FOR_EMAC | FIRST_OR_LAST_MASK | len); /* Increment index to point to the next BD */ @@ -579,8 +581,6 @@ static int arc_emac_tx(struct sk_buff *skb, struct net_device *ndev) arc_reg_set(priv, R_STATUS, TXPL_MASK); - skb_tx_timestamp(skb); - return NETDEV_TX_OK; } |