diff options
| author | Eric Dumazet <eric.dumazet@gmail.com> | 2011-06-19 14:52:36 +0200 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2011-06-20 01:28:03 +0200 |
| commit | 44da29d26bb8df3b0411ba902f2bc9b973ea38e4 (patch) | |
| tree | 1b96f414024459616c9a556926d83e2b20bdb5c5 /drivers | |
| parent | hp100: fix an skb->len race (diff) | |
| download | linux-44da29d26bb8df3b0411ba902f2bc9b973ea38e4.tar.xz linux-44da29d26bb8df3b0411ba902f2bc9b973ea38e4.zip | |
sgi-xp: fix a use after free
Its illegal to dereference skb after dev_kfree_skb(skb)
Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
CC: Robin Holt <holt@sgi.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/misc/sgi-xp/xpnet.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/drivers/misc/sgi-xp/xpnet.c b/drivers/misc/sgi-xp/xpnet.c index ee5109a3cd98..42f067347bc7 100644 --- a/drivers/misc/sgi-xp/xpnet.c +++ b/drivers/misc/sgi-xp/xpnet.c @@ -495,14 +495,14 @@ xpnet_dev_hard_start_xmit(struct sk_buff *skb, struct net_device *dev) } } + dev->stats.tx_packets++; + dev->stats.tx_bytes += skb->len; + if (atomic_dec_return(&queued_msg->use_count) == 0) { dev_kfree_skb(skb); kfree(queued_msg); } - dev->stats.tx_packets++; - dev->stats.tx_bytes += skb->len; - return NETDEV_TX_OK; } |