Fixes: 409c3b0c5f03 ("mac802154: tx: move stats tx increment")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <redacted>
Cc: Alexander Aring <alex.aring@gmail.com>
Cc: Stefan Schmidt <stefan@datenfreihafen.org>
Cc: linux-wpan@vger.kernel.org
---
  net/mac802154/tx.c | 8 +++++---
  1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/net/mac802154/tx.c b/net/mac802154/tx.c
index ab52811523e992f33f0855cdb711a2752b602e15..c829e4a7532564d401c0d2d1f90f56c2fe030b2c 100644
--- a/net/mac802154/tx.c
+++ b/net/mac802154/tx.c

@@ -34,11 +34,11 @@ void ieee802154_xmit_worker(struct work_struct *work)
  	if (res)
  		goto err_tx;
  
-	ieee802154_xmit_complete(&local->hw, skb, false);
-
  	dev->stats.tx_packets++;
  	dev->stats.tx_bytes += skb->len;
  
+	ieee802154_xmit_complete(&local->hw, skb, false);
+
  	return;
  
  err_tx:

@@ -78,6 +78,8 @@ ieee802154_tx(struct ieee802154_local *local, struct sk_buff *skb)
  
  	/* async is priority, otherwise sync is fallback */
  	if (local->ops->xmit_async) {
+		unsigned int len = skb->len;
+
  		ret = drv_xmit_async(local, skb);
  		if (ret) {
  			ieee802154_wake_queue(&local->hw);

@@ -85,7 +87,7 @@ ieee802154_tx(struct ieee802154_local *local, struct sk_buff *skb)
  		}
  
  		dev->stats.tx_packets++;
-		dev->stats.tx_bytes += skb->len;
+		dev->stats.tx_bytes += len;
  	} else {
  		local->tx_skb = skb;
  		queue_work(local->workqueue, &local->tx_work);