Commit 98ca4a46 authored by Patrick McHardy's avatar Patrick McHardy Committed by David S. Miller

net: fix network drivers ndo_start_xmit() return values (part 6)

Fix up hamradio drivers that return an errno value to dev_queue_xmit(), causing
it to print a warning an free the skb.

- bpqether: skb is freed: use after free

Compile tested only.
Signed-off-by: default avatarPatrick McHardy <kaber@trash.net>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent ae71bafd
...@@ -274,7 +274,7 @@ static int bpq_xmit(struct sk_buff *skb, struct net_device *dev) ...@@ -274,7 +274,7 @@ static int bpq_xmit(struct sk_buff *skb, struct net_device *dev)
if ((newskb = skb_realloc_headroom(skb, AX25_BPQ_HEADER_LEN)) == NULL) { if ((newskb = skb_realloc_headroom(skb, AX25_BPQ_HEADER_LEN)) == NULL) {
printk(KERN_WARNING "bpqether: out of memory\n"); printk(KERN_WARNING "bpqether: out of memory\n");
kfree_skb(skb); kfree_skb(skb);
return -ENOMEM; return NETDEV_TX_OK;
} }
if (skb->sk != NULL) if (skb->sk != NULL)
...@@ -294,7 +294,7 @@ static int bpq_xmit(struct sk_buff *skb, struct net_device *dev) ...@@ -294,7 +294,7 @@ static int bpq_xmit(struct sk_buff *skb, struct net_device *dev)
if ((dev = bpq_get_ether_dev(dev)) == NULL) { if ((dev = bpq_get_ether_dev(dev)) == NULL) {
dev->stats.tx_dropped++; dev->stats.tx_dropped++;
kfree_skb(skb); kfree_skb(skb);
return -ENODEV; return NETDEV_TX_OK;
} }
skb->protocol = ax25_type_trans(skb, dev); skb->protocol = ax25_type_trans(skb, dev);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment