Commit 4352d826 authored Dec 03, 2007 by Olof Johansson Committed by Jeff Garzik Dec 04, 2007

pasemi_mac: Fix reuse of free'd skb



Turns out we're freeing the skb when we detect CRC error, but we're
not clearing out info->skb. We could either clear it and have the stack
reallocate it, or just leave it and the rx ring refill code will reuse
the one that was allocated.

Reusing a freed skb obviously caused some nasty crashes of various kind,
as reported by Brent Baude and David Woodhouse.

Signed-off-by: Olof Johansson <olof@lixom.net>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

parent d30f53ae

drivers/net/pasemi_mac.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -586,7 +586,7 @@ static int pasemi_mac_clean_rx(struct pasemi_mac *mac, int limit)
		/* CRC error flagged */
		mac->netdev->stats.rx_errors++;
		mac->netdev->stats.rx_crc_errors++;
		dev_kfree_skb_irq(skb);
		/* No need to free skb, it'll be reused */
		goto next;
		}

Admin message