* [PATCH] sgi-xp: fix a use after free
@ 2011-06-19 22:52 Eric Dumazet
2011-06-19 23:34 ` David Miller
2011-06-20 2:44 ` Robin Holt
0 siblings, 2 replies; 4+ messages in thread
From: Eric Dumazet @ 2011-06-19 22:52 UTC (permalink / raw)
To: David Miller, Robin Holt; +Cc: netdev
Its illegal to dereference skb after dev_kfree_skb(skb)
Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
CC: Robin Holt <holt@sgi.com>
---
David, I am not sure Robin is active these days, maybe you can take this
patch, since its clearly network related ?
drivers/misc/sgi-xp/xpnet.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/misc/sgi-xp/xpnet.c b/drivers/misc/sgi-xp/xpnet.c
index ee5109a..42f0673 100644
--- a/drivers/misc/sgi-xp/xpnet.c
+++ b/drivers/misc/sgi-xp/xpnet.c
@@ -495,14 +495,14 @@ xpnet_dev_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
}
}
+ dev->stats.tx_packets++;
+ dev->stats.tx_bytes += skb->len;
+
if (atomic_dec_return(&queued_msg->use_count) == 0) {
dev_kfree_skb(skb);
kfree(queued_msg);
}
- dev->stats.tx_packets++;
- dev->stats.tx_bytes += skb->len;
-
return NETDEV_TX_OK;
}
^ permalink raw reply related [flat|nested] 4+ messages in thread* Re: [PATCH] sgi-xp: fix a use after free
2011-06-19 22:52 [PATCH] sgi-xp: fix a use after free Eric Dumazet
@ 2011-06-19 23:34 ` David Miller
2011-06-20 2:44 ` Robin Holt
1 sibling, 0 replies; 4+ messages in thread
From: David Miller @ 2011-06-19 23:34 UTC (permalink / raw)
To: eric.dumazet; +Cc: holt, netdev
From: Eric Dumazet <eric.dumazet@gmail.com>
Date: Mon, 20 Jun 2011 00:52:36 +0200
> Its illegal to dereference skb after dev_kfree_skb(skb)
>
> Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
> CC: Robin Holt <holt@sgi.com>
> ---
> David, I am not sure Robin is active these days, maybe you can take this
> patch, since its clearly network related ?
Right.
Applied, thanks.
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH] sgi-xp: fix a use after free
2011-06-19 22:52 [PATCH] sgi-xp: fix a use after free Eric Dumazet
2011-06-19 23:34 ` David Miller
@ 2011-06-20 2:44 ` Robin Holt
2011-06-20 3:19 ` David Miller
1 sibling, 1 reply; 4+ messages in thread
From: Robin Holt @ 2011-06-20 2:44 UTC (permalink / raw)
To: Eric Dumazet; +Cc: David Miller, Robin Holt, netdev
Thank you Eric.
David, if you want me to submit this through Andrew Morton, I can do
that instead.
Acked-by: Robin Holt <holt@sgi.com>
On Mon, Jun 20, 2011 at 12:52:36AM +0200, Eric Dumazet wrote:
> Its illegal to dereference skb after dev_kfree_skb(skb)
>
> Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
> CC: Robin Holt <holt@sgi.com>
> ---
> David, I am not sure Robin is active these days, maybe you can take this
> patch, since its clearly network related ?
>
> drivers/misc/sgi-xp/xpnet.c | 6 +++---
> 1 file changed, 3 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/misc/sgi-xp/xpnet.c b/drivers/misc/sgi-xp/xpnet.c
> index ee5109a..42f0673 100644
> --- a/drivers/misc/sgi-xp/xpnet.c
> +++ b/drivers/misc/sgi-xp/xpnet.c
> @@ -495,14 +495,14 @@ xpnet_dev_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
> }
> }
>
> + dev->stats.tx_packets++;
> + dev->stats.tx_bytes += skb->len;
> +
> if (atomic_dec_return(&queued_msg->use_count) == 0) {
> dev_kfree_skb(skb);
> kfree(queued_msg);
> }
>
> - dev->stats.tx_packets++;
> - dev->stats.tx_bytes += skb->len;
> -
> return NETDEV_TX_OK;
> }
>
>
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2011-06-20 3:19 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2011-06-19 22:52 [PATCH] sgi-xp: fix a use after free Eric Dumazet
2011-06-19 23:34 ` David Miller
2011-06-20 2:44 ` Robin Holt
2011-06-20 3:19 ` David Miller
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).