mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-12 05:48:40 +00:00
[PATCH] Use after free in net/tulip/de2104x.c
hi, this fixes coverity bug #912, where skb is freed first, and dereferenced a few lines later with skb->len. Signed-off-by: Eric Sesterhenn <snakebyte@gmx.de> Signed-off-by: Jeff Garzik <jeff@garzik.org>
This commit is contained in:
parent
494aced2cd
commit
5185c7c20a
1 changed files with 1 additions and 1 deletions
|
@ -1327,11 +1327,11 @@ static void de_clean_rings (struct de_private *de)
|
|||
struct sk_buff *skb = de->tx_skb[i].skb;
|
||||
if ((skb) && (skb != DE_DUMMY_SKB)) {
|
||||
if (skb != DE_SETUP_SKB) {
|
||||
dev_kfree_skb(skb);
|
||||
de->net_stats.tx_dropped++;
|
||||
pci_unmap_single(de->pdev,
|
||||
de->tx_skb[i].mapping,
|
||||
skb->len, PCI_DMA_TODEVICE);
|
||||
dev_kfree_skb(skb);
|
||||
} else {
|
||||
pci_unmap_single(de->pdev,
|
||||
de->tx_skb[i].mapping,
|
||||
|
|
Loading…
Reference in a new issue