Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 5185c7c2 authored Mar 22, 2006 by Eric Sesterhenn Committed by Jeff Garzik Mar 22, 2006

[PATCH] Use after free in net/tulip/de2104x.c



hi,

this fixes coverity bug #912, where skb is freed first,
and dereferenced a few lines later with skb->len.

Signed-off-by: Eric Sesterhenn <snakebyte@gmx.de>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

parent 494aced2

drivers/net/tulip/de2104x.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -1327,11 +1327,11 @@ static void de_clean_rings (struct de_private *de)
		struct sk_buff *skb = de->tx_skb[i].skb;
		if ((skb) && (skb != DE_DUMMY_SKB)) {
		if (skb != DE_SETUP_SKB) {
		dev_kfree_skb(skb);
		de->net_stats.tx_dropped++;
		pci_unmap_single(de->pdev,
		de->tx_skb[i].mapping,
		skb->len, PCI_DMA_TODEVICE);
		dev_kfree_skb(skb);
		} else {
		pci_unmap_single(de->pdev,
		de->tx_skb[i].mapping,