Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 79c5f51c authored by Eric Dumazet's avatar Eric Dumazet Committed by David S. Miller
Browse files

irda: fix a race in irlan_eth_xmit() 



After skb is queued, its illegal to dereference it.

Cache skb->len into a temporary variable.

Signed-off-by: default avatarEric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 9c38657c

net/irda/irlan/irlan_eth.c

+3 −1
Original line number Original line Diff line number Diff line
@@ -169,6 +169,7 @@ static netdev_tx_t irlan_eth_xmit(struct sk_buff *skb, 
{

{

	struct irlan_cb *self = netdev_priv(dev);

	struct irlan_cb *self = netdev_priv(dev);

	int ret;

	int ret;

	unsigned int len;





	/* skb headroom large enough to contain all IrDA-headers? */

	/* skb headroom large enough to contain all IrDA-headers? */

	if ((skb_headroom(skb) < self->max_header_size) || (skb_shared(skb))) {

	if ((skb_headroom(skb) < self->max_header_size) || (skb_shared(skb))) {
@@ -188,6 +189,7 @@ static netdev_tx_t irlan_eth_xmit(struct sk_buff *skb, 




	dev->trans_start = jiffies;

	dev->trans_start = jiffies;





	len = skb->len;

	/* Now queue the packet in the transport layer */

	/* Now queue the packet in the transport layer */

	if (self->use_udata)

	if (self->use_udata)

		ret = irttp_udata_request(self->tsap_data, skb);

		ret = irttp_udata_request(self->tsap_data, skb);
@@ -209,7 +211,7 @@ static netdev_tx_t irlan_eth_xmit(struct sk_buff *skb, 
		self->stats.tx_dropped++;

		self->stats.tx_dropped++;

	} else {

	} else {

		self->stats.tx_packets++;

		self->stats.tx_packets++;

		self->stats.tx_bytes += skb->len;

		self->stats.tx_bytes += len;

	}

	}





	return NETDEV_TX_OK;

	return NETDEV_TX_OK;