[PATCH] sgi-xp: fix a use after free

Its illegal to dereference skb after dev_kfree_skb(skb)

Signed-off-by: Eric Dumazet <redacted>
CC: Robin Holt <redacted>
---
David, I am not sure Robin is active these days, maybe you can take this
patch, since its clearly network related ?

 drivers/misc/sgi-xp/xpnet.c |    6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/misc/sgi-xp/xpnet.c b/drivers/misc/sgi-xp/xpnet.c
index ee5109a..42f0673 100644
--- a/drivers/misc/sgi-xp/xpnet.c
+++ b/drivers/misc/sgi-xp/xpnet.c

@@ -495,14 +495,14 @@ xpnet_dev_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
 		}
 	}
 
+	dev->stats.tx_packets++;
+	dev->stats.tx_bytes += skb->len;
+
 	if (atomic_dec_return(&queued_msg->use_count) == 0) {
 		dev_kfree_skb(skb);
 		kfree(queued_msg);
 	}
 
-	dev->stats.tx_packets++;
-	dev->stats.tx_bytes += skb->len;
-
 	return NETDEV_TX_OK;
 }
 

From: Eric Dumazet <redacted>
Date: Mon, 20 Jun 2011 00:52:36 +0200

Its illegal to dereference skb after dev_kfree_skb(skb)

Signed-off-by: Eric Dumazet <redacted>
CC: Robin Holt <redacted>
---
David, I am not sure Robin is active these days, maybe you can take this
patch, since its clearly network related ?

Right.

Applied, thanks.

Thank you Eric.

David, if you want me to submit this through Andrew Morton, I can do
that instead.


Acked-by: Robin Holt <redacted>


On Mon, Jun 20, 2011 at 12:52:36AM +0200, Eric Dumazet wrote:

From: Robin Holt <redacted>
Date: Sun, 19 Jun 2011 21:44:56 -0500

Thank you Eric.

David, if you want me to submit this through Andrew Morton, I can do
that instead.

I applied it to my net-2.6 tree long before you replied.