Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 7a2a8451 authored by Eric Dumazet's avatar Eric Dumazet Committed by David S. Miller
Browse files

net: fec: fix potential use after free 



skb_tx_timestamp(skb) should be called _before_ TX completion
has a chance to trigger, otherwise it is too late and we access
freed memory.

Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
Fixes: de5fb0a0 ("net: fec: put tx to napi poll function to fix dead lock")
Cc: Frank Li <Frank.Li@freescale.com>
Cc: Richard Cochran <richardcochran@gmail.com>
Acked-by: default avatarRichard Cochran <richardcochran@gmail.com>
Acked-by: default avatarFrank Li <Frank.Li@freescale.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent c047e070

drivers/net/ethernet/freescale/fec_main.c

+2 −2
Original line number Diff line number Diff line
@@ -428,6 +428,8 @@ fec_enet_start_xmit(struct sk_buff *skb, struct net_device *ndev) 
	/* If this was the last BD in the ring, start at the beginning again. */

	bdp = fec_enet_get_nextdesc(bdp, fep);



	skb_tx_timestamp(skb);



	fep->cur_tx = bdp;



	if (fep->cur_tx == fep->dirty_tx)
@@ -436,8 +438,6 @@ fec_enet_start_xmit(struct sk_buff *skb, struct net_device *ndev) 
	/* Trigger transmission start */

	writel(0, fep->hwp + FEC_X_DES_ACTIVE);



	skb_tx_timestamp(skb);



	return NETDEV_TX_OK;

}