diff options
| author | Olof Johansson <olof@lixom.net> | 2007-12-04 04:34:14 +0100 |
|---|---|---|
| committer | Jeff Garzik <jeff@garzik.org> | 2007-12-04 20:53:49 +0100 |
| commit | 4352d82647f679fb8dd9440b34400fa49beedb2c (patch) | |
| tree | 667455cf1c3fa8c3085c93bbf3e0755b6fb28fe6 /drivers/net/pasemi_mac.c | |
| parent | SMC911X: Fix using of dereferenced skb after netif_rx (diff) | |
| download | linux-4352d82647f679fb8dd9440b34400fa49beedb2c.tar.xz linux-4352d82647f679fb8dd9440b34400fa49beedb2c.zip | |
pasemi_mac: Fix reuse of free'd skb
Turns out we're freeing the skb when we detect CRC error, but we're
not clearing out info->skb. We could either clear it and have the stack
reallocate it, or just leave it and the rx ring refill code will reuse
the one that was allocated.
Reusing a freed skb obviously caused some nasty crashes of various kind,
as reported by Brent Baude and David Woodhouse.
Signed-off-by: Olof Johansson <olof@lixom.net>
Signed-off-by: Jeff Garzik <jeff@garzik.org>
Diffstat (limited to 'drivers/net/pasemi_mac.c')
| -rw-r--r-- | drivers/net/pasemi_mac.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/net/pasemi_mac.c b/drivers/net/pasemi_mac.c index a8db5d7105fb..816a59e801b2 100644 --- a/drivers/net/pasemi_mac.c +++ b/drivers/net/pasemi_mac.c @@ -586,7 +586,7 @@ static int pasemi_mac_clean_rx(struct pasemi_mac *mac, int limit) /* CRC error flagged */ mac->netdev->stats.rx_errors++; mac->netdev->stats.rx_crc_errors++; - dev_kfree_skb_irq(skb); + /* No need to free skb, it'll be reused */ goto next; } |