Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit cd8f76c0 authored by Eric Dumazet's avatar Eric Dumazet Committed by David S. Miller
Browse files

be2net: fix a race in be_xmit() 



As soon as hardware is notified of a transmit, we no longer can assume
skb can be dereferenced, as TX completion might have freed the packet.

Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
Cc: Sathya Perla <sathya.perla@emulex.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 4399a4df

drivers/net/ethernet/emulex/benet/be_main.c

+3 −2
Original line number Diff line number Diff line
@@ -736,6 +736,8 @@ static netdev_tx_t be_xmit(struct sk_buff *skb, 


	copied = make_tx_wrbs(adapter, txq, skb, wrb_cnt, dummy_wrb);

	if (copied) {

		int gso_segs = skb_shinfo(skb)->gso_segs;



		/* record the sent skb in the sent_skb table */

		BUG_ON(txo->sent_skb_list[start]);

		txo->sent_skb_list[start] = skb;
@@ -753,8 +755,7 @@ static netdev_tx_t be_xmit(struct sk_buff *skb, 


		be_txq_notify(adapter, txq->id, wrb_cnt);



		be_tx_stats_update(txo, wrb_cnt, copied,

				skb_shinfo(skb)->gso_segs, stopped);

		be_tx_stats_update(txo, wrb_cnt, copied, gso_segs, stopped);

	} else {

		txq->head = start;

		dev_kfree_skb_any(skb);