Commit 9e927fb6 authored Mar 10, 2006 by David S. Miller Committed by Jeff Garzik Mar 11, 2006

[PATCH] Wrong return value corrupts free object in e1000 driver



For some reason, E1000's ->hard_start_xmit() routine returns -EFAULT
instead of one of the NETDEV_TX_* error codes.  In fact, it frees up
the SKB before returning this.  This makes the queueing layer think
the packet should be requeued and subsequently we corrupt a freed
object.

Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

parent 5ee33b7a

drivers/net/e1000/e1000_main.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -2917,7 +2917,7 @@ e1000_xmit_frame(struct sk_buff skb, struct net_device netdev)
		if (!__pskb_pull_tail(skb, pull_size)) {
		printk(KERN_ERR "__pskb_pull_tail failed.\n");
		dev_kfree_skb_any(skb);
		return -EFAULT;
		return NETDEV_TX_OK;
		}
		len = skb->len - skb->data_len;
		}