Messages in this thread Patch in this message | | | Subject | [Patch] Use after free in net/tulip/de2104x.c | From | Eric Sesterhenn <> | Date | Wed, 22 Mar 2006 22:30:34 +0100 |
| |
hi,
this fixes coverity bug #912, where skb is freed first, and dereferenced a few lines later with skb->len.
Signed-off-by: Eric Sesterhenn <snakebyte@gmx.de>
--- linux-2.6.16/drivers/net/tulip/de2104x.c.orig 2006-03-22 22:21:53.000000000 +0100 +++ linux-2.6.16/drivers/net/tulip/de2104x.c 2006-03-22 22:25:31.000000000 +0100 @@ -1332,11 +1332,11 @@ static void de_clean_rings (struct de_pr struct sk_buff *skb = de->tx_skb[i].skb; if ((skb) && (skb != DE_DUMMY_SKB)) { if (skb != DE_SETUP_SKB) { - dev_kfree_skb(skb); de->net_stats.tx_dropped++; pci_unmap_single(de->pdev, de->tx_skb[i].mapping, skb->len, PCI_DMA_TODEVICE); + dev_kfree_skb(skb); } else { pci_unmap_single(de->pdev, de->tx_skb[i].mapping,
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |