[PATCH] sgi-xp: fix a use after free
From: Eric Dumazet <hidden>
Date: 2011-06-19 22:52:44
Subsystem:
char and misc drivers, sgi xp/xpc/xpnet driver, the rest · Maintainers:
Arnd Bergmann, Greg Kroah-Hartman, Robin Holt, Steve Wahl, Linus Torvalds
Its illegal to dereference skb after dev_kfree_skb(skb) Signed-off-by: Eric Dumazet <redacted> CC: Robin Holt <redacted> --- David, I am not sure Robin is active these days, maybe you can take this patch, since its clearly network related ? drivers/misc/sgi-xp/xpnet.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/misc/sgi-xp/xpnet.c b/drivers/misc/sgi-xp/xpnet.c
index ee5109a..42f0673 100644
--- a/drivers/misc/sgi-xp/xpnet.c
+++ b/drivers/misc/sgi-xp/xpnet.c@@ -495,14 +495,14 @@ xpnet_dev_hard_start_xmit(struct sk_buff *skb, struct net_device *dev) } } + dev->stats.tx_packets++; + dev->stats.tx_bytes += skb->len; + if (atomic_dec_return(&queued_msg->use_count) == 0) { dev_kfree_skb(skb); kfree(queued_msg); } - dev->stats.tx_packets++; - dev->stats.tx_bytes += skb->len; - return NETDEV_TX_OK; }