Commit 5185c7c2 authored by Eric Sesterhenn's avatar Eric Sesterhenn Committed by Jeff Garzik

[PATCH] Use after free in net/tulip/de2104x.c

hi,

this fixes coverity bug #912, where skb is freed first,
and dereferenced a few lines later with skb->len.
Signed-off-by: default avatarEric Sesterhenn <snakebyte@gmx.de>
Signed-off-by: default avatarJeff Garzik <jeff@garzik.org>
parent 494aced2
......@@ -1327,11 +1327,11 @@ static void de_clean_rings (struct de_private *de)
struct sk_buff *skb = de->tx_skb[i].skb;
if ((skb) && (skb != DE_DUMMY_SKB)) {
if (skb != DE_SETUP_SKB) {
dev_kfree_skb(skb);
de->net_stats.tx_dropped++;
pci_unmap_single(de->pdev,
de->tx_skb[i].mapping,
skb->len, PCI_DMA_TODEVICE);
dev_kfree_skb(skb);
} else {
pci_unmap_single(de->pdev,
de->tx_skb[i].mapping,
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment