Skip to content

Commit

Permalink
pasemi_mac: Fix reuse of free'd skb
Browse files Browse the repository at this point in the history
Turns out we're freeing the skb when we detect CRC error, but we're
not clearing out info->skb. We could either clear it and have the stack
reallocate it, or just leave it and the rx ring refill code will reuse
the one that was allocated.

Reusing a freed skb obviously caused some nasty crashes of various kind,
as reported by Brent Baude and David Woodhouse.

Signed-off-by: Olof Johansson <olof@lixom.net>
Signed-off-by: Jeff Garzik <jeff@garzik.org>
  • Loading branch information
Olof Johansson authored and Jeff Garzik committed Dec 4, 2007
1 parent d30f53a commit 4352d82
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion drivers/net/pasemi_mac.c
Original file line number Diff line number Diff line change
Expand Up @@ -586,7 +586,7 @@ static int pasemi_mac_clean_rx(struct pasemi_mac *mac, int limit)
/* CRC error flagged */
mac->netdev->stats.rx_errors++;
mac->netdev->stats.rx_crc_errors++;
dev_kfree_skb_irq(skb);
/* No need to free skb, it'll be reused */
goto next;
}

Expand Down

0 comments on commit 4352d82

Please sign in to comment.