From patchwork Mon Oct 11 09:26:56 2010 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jiri Slaby X-Patchwork-Id: 67401 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id D7761B70A7 for ; Mon, 11 Oct 2010 20:28:35 +1100 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753924Ab0JKJ1U (ORCPT ); Mon, 11 Oct 2010 05:27:20 -0400 Received: from mail.pripojeni.net ([217.66.174.14]:54184 "EHLO smtp.pripojeni.net" rhost-flags-OK-FAIL-OK-OK) by vger.kernel.org with ESMTP id S1753504Ab0JKJ1H (ORCPT ); Mon, 11 Oct 2010 05:27:07 -0400 Received: from localhost.localdomain ([217.66.174.142]) by smtp.pripojeni.net (Kerio Connect 7.1.1); Mon, 11 Oct 2010 11:26:59 +0200 From: Jiri Slaby To: davem@davemloft.net Cc: netdev@vger.kernel.org, linux-kernel@vger.kernel.org, jirislaby@gmail.com, Masayuki Ohtake Subject: [PATCH 1/3] NET: pch, fix use after free Date: Mon, 11 Oct 2010 11:26:56 +0200 Message-Id: <1286789218-13976-1-git-send-email-jslaby@suse.cz> X-Mailer: git-send-email 1.7.3.1 Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org Stanse found that pch_gbe_xmit_frame uses skb after it is freed. Fix that. Signed-off-by: Jiri Slaby Cc: Masayuki Ohtake Acked-by: Eric Dumazet --- drivers/net/pch_gbe/pch_gbe_main.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/drivers/net/pch_gbe/pch_gbe_main.c b/drivers/net/pch_gbe/pch_gbe_main.c index 53c56cf..e44644f 100644 --- a/drivers/net/pch_gbe/pch_gbe_main.c +++ b/drivers/net/pch_gbe/pch_gbe_main.c @@ -1847,9 +1847,9 @@ static int pch_gbe_xmit_frame(struct sk_buff *skb, struct net_device *netdev) unsigned long flags; if (unlikely(skb->len > (adapter->hw.mac.max_frame_size - 4))) { - dev_kfree_skb_any(skb); pr_err("Transfer length Error: skb len: %d > max: %d\n", skb->len, adapter->hw.mac.max_frame_size); + dev_kfree_skb_any(skb); adapter->stats.tx_length_errors++; return NETDEV_TX_OK; }