irda: fix a race in irlan_eth_xmit() (79c5f51c) · Commits · 戴 / test

After skb is queued, its illegal to dereference it. Cache skb->len into a temporary variable. Signed-off-by:

net/irda/irlan/irlan_eth.c

+3 −1

Original line number	Diff line number	Diff line
		@@ -169,6 +169,7 @@ static netdev_tx_t irlan_eth_xmit(struct sk_buff *skb,
		{
		struct irlan_cb *self = netdev_priv(dev);
		int ret;
		unsigned int len;

		/* skb headroom large enough to contain all IrDA-headers? */
		if ((skb_headroom(skb) < self->max_header_size) \|\| (skb_shared(skb))) {
		@@ -188,6 +189,7 @@ static netdev_tx_t irlan_eth_xmit(struct sk_buff *skb,

		dev->trans_start = jiffies;

		len = skb->len;
		/* Now queue the packet in the transport layer */
		if (self->use_udata)
		ret = irttp_udata_request(self->tsap_data, skb);
		@@ -209,7 +211,7 @@ static netdev_tx_t irlan_eth_xmit(struct sk_buff *skb,
		self->stats.tx_dropped++;
		} else {
		self->stats.tx_packets++;
		self->stats.tx_bytes += skb->len;
		self->stats.tx_bytes += len;
		}

		return NETDEV_TX_OK;