Skip to contentSkip to conversation

bagetlance using freed skb

PATCH New Arnaldo Carvalho de Melo 1 participant 2 messages Jan 6, 2001 – Jan 7, 2001 Network drivers

lore
Share & tools
lore

Arnaldo Carvalho de Melo

author
#0 lore raw

PATCH 1/1 bagetlance using freed skb

Alan,

Paul Gortmaker found a similar one for lance, so I'm looking at
some other drivers to see if this happens, bagetlance has it as well, here is the patch.

- Arnaldo

drivers/net/bagetlance.c +1 -1
@@ -930,9 +930,9 @@
 #else
     SET_FLAG(head,(TMD1_OWN_CHIP | TMD1_ENP | TMD1_STP));
 #endif
+	lp->stats.tx_bytes += skb->len;
 	dev_kfree_skb( skb );
 	lp->cur_tx++;
-	lp->stats.tx_bytes += skb->len;
 	while( lp->cur_tx >= TX_RING_SIZE && lp->dirty_tx >= TX_RING_SIZE ) {
 		lp->cur_tx -= TX_RING_SIZE;
 		lp->dirty_tx -= TX_RING_SIZE;

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to [email protected]
Please read the FAQ at http://www.tux.org/lkml/

author
#1 lore raw

PATCH 1/1 atarilance using freed skb

Em Sat, Jan 06, 2001 at 09:35:08PM -0200, Arnaldo Carvalho de Melo escreveu:

Quoted 5 lines

Alan,

Paul Gortmaker found a similar one for lance, so I'm looking at
some other drivers to see if this happens, bagetlance has it as well, here is the patch.

Another one:

drivers/net/atarilance.c +1 -1
@@ -820,9 +820,9 @@
 	head->misc = 0;
 	lp->memcpy_f( PKTBUF_ADDR(head), (void *)skb->data, skb->len );
 	head->flag = TMD1_OWN_CHIP | TMD1_ENP | TMD1_STP;
+	lp->stats.tx_bytes += skb->len;
 	dev_kfree_skb( skb );
 	lp->cur_tx++;
-	lp->stats.tx_bytes += skb->len;
 	while( lp->cur_tx >= TX_RING_SIZE && lp->dirty_tx >= TX_RING_SIZE ) {
 		lp->cur_tx -= TX_RING_SIZE;
 		lp->dirty_tx -= TX_RING_SIZE;

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to [email protected]
Please read the FAQ at http://www.tux.org/lkml/