Re: [PATCH] sgi-xp: fix a use after free
From: Robin Holt <hidden>
Date: 2011-06-20 02:44:57
Thank you Eric. David, if you want me to submit this through Andrew Morton, I can do that instead. Acked-by: Robin Holt <redacted> On Mon, Jun 20, 2011 at 12:52:36AM +0200, Eric Dumazet wrote:
quoted hunk ↗ jump to hunk
Its illegal to dereference skb after dev_kfree_skb(skb) Signed-off-by: Eric Dumazet <redacted> CC: Robin Holt <redacted> --- David, I am not sure Robin is active these days, maybe you can take this patch, since its clearly network related ? drivers/misc/sgi-xp/xpnet.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)diff --git a/drivers/misc/sgi-xp/xpnet.c b/drivers/misc/sgi-xp/xpnet.c index ee5109a..42f0673 100644 --- a/drivers/misc/sgi-xp/xpnet.c +++ b/drivers/misc/sgi-xp/xpnet.c@@ -495,14 +495,14 @@ xpnet_dev_hard_start_xmit(struct sk_buff *skb, struct net_device *dev) } } + dev->stats.tx_packets++; + dev->stats.tx_bytes += skb->len; + if (atomic_dec_return(&queued_msg->use_count) == 0) { dev_kfree_skb(skb); kfree(queued_msg); } - dev->stats.tx_packets++; - dev->stats.tx_bytes += skb->len; - return NETDEV_TX_OK; }