Message ID | 1286786794-10410-1-git-send-email-jslaby@suse.cz |
---|---|
State | Accepted, archived |
Delegated to: | David Miller |
Headers | show |
Le lundi 11 octobre 2010 à 10:46 +0200, Jiri Slaby a écrit : > Stanse found that mpc_push frees skb and then it dereferences it. It > is a typo, new_skb should be dereferenced there. > > Signed-off-by: Jiri Slaby <jslaby@suse.cz> > Cc: Eric Dumazet <eric.dumazet@gmail.com> > --- > net/atm/mpc.c | 2 +- > 1 files changed, 1 insertions(+), 1 deletions(-) > > diff --git a/net/atm/mpc.c b/net/atm/mpc.c > index 622b471..74bcc66 100644 > --- a/net/atm/mpc.c > +++ b/net/atm/mpc.c > @@ -778,7 +778,7 @@ static void mpc_push(struct atm_vcc *vcc, struct sk_buff *skb) > eg->packets_rcvd++; > mpc->eg_ops->put(eg); > > - memset(ATM_SKB(skb), 0, sizeof(struct atm_skb_data)); > + memset(ATM_SKB(new_skb), 0, sizeof(struct atm_skb_data)); > netif_rx(new_skb); > } > Acked-by: Eric Dumazet <eric.dumazet@gmail.com> -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
From: Eric Dumazet <eric.dumazet@gmail.com> Date: Mon, 11 Oct 2010 10:59:40 +0200 > Le lundi 11 octobre 2010 à 10:46 +0200, Jiri Slaby a écrit : >> Stanse found that mpc_push frees skb and then it dereferences it. It >> is a typo, new_skb should be dereferenced there. >> >> Signed-off-by: Jiri Slaby <jslaby@suse.cz> >> Cc: Eric Dumazet <eric.dumazet@gmail.com> ... > Acked-by: Eric Dumazet <eric.dumazet@gmail.com> Applied. -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/net/atm/mpc.c b/net/atm/mpc.c index 622b471..74bcc66 100644 --- a/net/atm/mpc.c +++ b/net/atm/mpc.c @@ -778,7 +778,7 @@ static void mpc_push(struct atm_vcc *vcc, struct sk_buff *skb) eg->packets_rcvd++; mpc->eg_ops->put(eg); - memset(ATM_SKB(skb), 0, sizeof(struct atm_skb_data)); + memset(ATM_SKB(new_skb), 0, sizeof(struct atm_skb_data)); netif_rx(new_skb); }
Stanse found that mpc_push frees skb and then it dereferences it. It is a typo, new_skb should be dereferenced there. Signed-off-by: Jiri Slaby <jslaby@suse.cz> Cc: Eric Dumazet <eric.dumazet@gmail.com> --- net/atm/mpc.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-)