diff options
| author | Eric Sesterhenn <snakebyte@gmx.de> | 2006-03-22 22:30:34 +0100 |
|---|---|---|
| committer | Jeff Garzik <jeff@garzik.org> | 2006-03-22 20:30:45 -0500 |
| commit | 5185c7c20a4b88892f868ad8d92d1b640b1edba9 (patch) | |
| tree | 53674f28e6dd666a59f5495f73149736ec260505 /drivers/net/tulip | |
| parent | 494aced2cda34c186083f7d53c419426eea3d584 (diff) | |
[PATCH] Use after free in net/tulip/de2104x.c
hi,
this fixes coverity bug #912, where skb is freed first,
and dereferenced a few lines later with skb->len.
Signed-off-by: Eric Sesterhenn <snakebyte@gmx.de>
Signed-off-by: Jeff Garzik <jeff@garzik.org>
Diffstat (limited to 'drivers/net/tulip')
| -rw-r--r-- | drivers/net/tulip/de2104x.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/net/tulip/de2104x.c b/drivers/net/tulip/de2104x.c index 6299e186c73..e3dd144d326 100644 --- a/drivers/net/tulip/de2104x.c +++ b/drivers/net/tulip/de2104x.c @@ -1327,11 +1327,11 @@ static void de_clean_rings (struct de_private *de) struct sk_buff *skb = de->tx_skb[i].skb; if ((skb) && (skb != DE_DUMMY_SKB)) { if (skb != DE_SETUP_SKB) { - dev_kfree_skb(skb); de->net_stats.tx_dropped++; pci_unmap_single(de->pdev, de->tx_skb[i].mapping, skb->len, PCI_DMA_TODEVICE); + dev_kfree_skb(skb); } else { pci_unmap_single(de->pdev, de->tx_skb[i].mapping, |