Messages in this thread |  | | | Date | Tue, 4 Apr 2006 17:22:37 -0700 | | From | "Randy.Dunlap" <> | | Subject | Re: [patch 02/26] USB: Fix irda-usb use after use |
| |
On Tue, 4 Apr 2006 16:59:43 -0700 gregkh@suse.de wrote:
> Don't read from free'd memory after calling netif_rx(). docopy is used as > a boolean (0 and 1) so unsigned int is sufficient. > > Coverity bug #928 > > Signed-off-by: Eugene Teo <eugene.teo@eugeneteo.net> > Cc: "David Miller" <davem@davemloft.net> > Signed-off-by: Andrew Morton <akpm@osdl.org> > Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> > > --- > > drivers/net/irda/irda-usb.c | 5 +++-- > 1 file changed, 3 insertions(+), 2 deletions(-) > > --- linux-2.6.16.1.orig/drivers/net/irda/irda-usb.c > +++ linux-2.6.16.1/drivers/net/irda/irda-usb.c > @@ -740,7 +740,7 @@ static void irda_usb_receive(struct urb > struct sk_buff *newskb; > struct sk_buff *dataskb; > struct urb *next_urb; > - int docopy; > + unsigned int len, docopy; >
Is the <docopy> part of the patch just a convenience so that the patch doesn't have to be split? I don't see this part as critical.
> IRDA_DEBUG(2, "%s(), len=%d\n", __FUNCTION__, urb->actual_length); > > @@ -851,10 +851,11 @@ static void irda_usb_receive(struct urb > dataskb->dev = self->netdev; > dataskb->mac.raw = dataskb->data; > dataskb->protocol = htons(ETH_P_IRDA); > + len = dataskb->len; > netif_rx(dataskb); > > /* Keep stats up to date */ > - self->stats.rx_bytes += dataskb->len; > + self->stats.rx_bytes += len; > self->stats.rx_packets++; > self->netdev->last_rx = jiffies; > >
--- ~Randy - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
|  |