Messages in this thread Patch in this message | | | Date | Wed, 15 Mar 2006 11:08:27 +0800 | From | Eugene Teo <> | Subject | Fix irda-usb use after use |
| |
Don't read from free'd memory after calling netif_rx(). docopy is used as a boolean (0 and 1) so unsigned int is sufficient.
Coverity bug #928
Signed-off-by: Eugene Teo <eugene.teo@eugeneteo.net>
--- linux-2.6/drivers/net/irda/irda-usb.c~ 2006-03-15 10:05:35.000000000 +0800 +++ linux-2.6/drivers/net/irda/irda-usb.c 2006-03-15 11:06:01.000000000 +0800 @@ -740,7 +740,7 @@ struct sk_buff *newskb; struct sk_buff *dataskb; struct urb *next_urb; - int docopy; + unsigned int len, docopy; IRDA_DEBUG(2, "%s(), len=%d\n", __FUNCTION__, urb->actual_length); @@ -851,10 +851,11 @@ dataskb->dev = self->netdev; dataskb->mac.raw = dataskb->data; dataskb->protocol = htons(ETH_P_IRDA); + len = dataskb->len; netif_rx(dataskb); /* Keep stats up to date */ - self->stats.rx_bytes += dataskb->len; + self->stats.rx_bytes += len; self->stats.rx_packets++; self->netdev->last_rx = jiffies; -- 1024D/A6D12F80 print D51D 2633 8DAC 04DB 7265 9BB8 5883 6DAA A6D1 2F80 main(i) { putchar(182623909 >> (i-1) * 5&31|!!(i<7)<<6) && main(++i); } - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |