From mboxrd@z Thu Jan 1 00:00:00 1970 From: linas@austin.ibm.com (Linas Vepstas) Subject: [PATCH 6/18] spidernet: null out skb pointer after its been used. Date: Thu, 7 Jun 2007 14:29:52 -0500 Message-ID: <20070607192952.GF16077@austin.ibm.com> References: <20070607191707.GA7904@austin.ibm.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Cc: cbe-oss-dev@ozlabs.org, netdev@vger.kernel.org To: Jeff Garzik Return-path: Received: from e1.ny.us.ibm.com ([32.97.182.141]:38869 "EHLO e1.ny.us.ibm.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S933259AbXFGT34 (ORCPT ); Thu, 7 Jun 2007 15:29:56 -0400 Received: from d01relay02.pok.ibm.com (d01relay02.pok.ibm.com [9.56.227.234]) by e1.ny.us.ibm.com (8.13.8/8.13.8) with ESMTP id l57JTrVs029256 for ; Thu, 7 Jun 2007 15:29:53 -0400 Received: from d01av02.pok.ibm.com (d01av02.pok.ibm.com [9.56.224.216]) by d01relay02.pok.ibm.com (8.13.8/8.13.8/NCO v8.3) with ESMTP id l57JTrO0505904 for ; Thu, 7 Jun 2007 15:29:53 -0400 Received: from d01av02.pok.ibm.com (loopback [127.0.0.1]) by d01av02.pok.ibm.com (8.12.11.20060308/8.13.3) with ESMTP id l57JTrLS009332 for ; Thu, 7 Jun 2007 15:29:53 -0400 Content-Disposition: inline In-Reply-To: <20070607191707.GA7904@austin.ibm.com> Sender: netdev-owner@vger.kernel.org List-Id: netdev.vger.kernel.org If the ethernet interface is brought down while there is still RX traffic in flight, the device shutdown routine can end up trying to double-free an skb, leading to a crash in mm/slab.c Avoid the double-free by nulling out the skb pointer. Signed-off-by: Linas Vepstas ---- drivers/net/spider_net.c | 1 + 1 file changed, 1 insertion(+) Index: linux-2.6.22-rc1/drivers/net/spider_net.c =================================================================== --- linux-2.6.22-rc1.orig/drivers/net/spider_net.c 2007-06-07 11:51:51.000000000 -0500 +++ linux-2.6.22-rc1/drivers/net/spider_net.c 2007-06-07 11:51:52.000000000 -0500 @@ -1132,6 +1132,7 @@ spider_net_decode_one_descr(struct spide /* Ok, we've got a packet in descr */ spider_net_pass_skb_up(descr, card); + descr->skb = NULL; hwdescr->dmac_cmd_status = SPIDER_NET_DESCR_NOT_IN_USE; return 1;