From: Patrick McHardy <kaber@trash.net>
To: "David S. Miller" <davem@davemloft.net>
Cc: Linux Netdev List <netdev@vger.kernel.org>,
j.dumon@option.com, Greg Kroah-Hartman <gregkh@suse.de>
Subject: net: fix network drivers ndo_start_xmit() return values (part 8)
Date: Fri, 12 Jun 2009 18:14:36 +0200 [thread overview]
Message-ID: <4A327EEC.5020300@trash.net> (raw)
[-- Attachment #1: Type: text/plain, Size: 0 bytes --]
[-- Attachment #2: 08.diff --]
[-- Type: text/x-patch, Size: 1636 bytes --]
commit 6c6e6eb6ee2b7ab91c73e51a5d7a438d2daa5b94
Author: Patrick McHardy <kaber@trash.net>
Date: Fri Jun 12 18:14:16 2009 +0200
net: fix network drivers ndo_start_xmit() return values (part 8)
Fix up USB drivers that return an errno value (result of usb_submit_urb())
to qdisc_restart(), causing qdisc_restart() to print a warning and requeue/
retransmit the skb.
- hso: skb is freed: use after free
- at76_usb: skb is freed: use after free
Compile tested only.
Signed-off-by: Patrick McHardy <kaber@trash.net>
diff --git a/drivers/net/usb/hso.c b/drivers/net/usb/hso.c
index e3580f4..f8c6d7e 100644
--- a/drivers/net/usb/hso.c
+++ b/drivers/net/usb/hso.c
@@ -816,7 +816,7 @@ static int hso_net_start_xmit(struct sk_buff *skb, struct net_device *net)
}
dev_kfree_skb(skb);
/* we're done */
- return result;
+ return NETDEV_TX_OK;
}
static void hso_get_drvinfo(struct net_device *net, struct ethtool_drvinfo *info)
diff --git a/drivers/staging/at76_usb/at76_usb.c b/drivers/staging/at76_usb/at76_usb.c
index c8af9a8..3f303ae 100644
--- a/drivers/staging/at76_usb/at76_usb.c
+++ b/drivers/staging/at76_usb/at76_usb.c
@@ -3242,12 +3242,11 @@ static int at76_tx(struct sk_buff *skb, struct net_device *netdev)
"%s: -EINVAL: tx urb %p hcpriv %p complete %p\n",
priv->netdev->name, priv->tx_urb,
priv->tx_urb->hcpriv, priv->tx_urb->complete);
- } else {
+ } else
stats->tx_bytes += skb->len;
- dev_kfree_skb(skb);
- }
- return ret;
+ dev_kfree_skb(skb);
+ return NETDEV_TX_OK;
}
static void at76_tx_timeout(struct net_device *netdev)
reply other threads:[~2009-06-12 16:14 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=4A327EEC.5020300@trash.net \
--to=kaber@trash.net \
--cc=davem@davemloft.net \
--cc=gregkh@suse.de \
--cc=j.dumon@option.com \
--cc=netdev@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.