lkml.org 
[lkml]   [2006]   [Apr]   [4]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
DateTue, 4 Apr 2006 17:22:37 -0700
From"Randy.Dunlap" <>
SubjectRe: [patch 02/26] USB: Fix irda-usb use after use
On Tue, 4 Apr 2006 16:59:43 -0700 gregkh@suse.de wrote:

> Don't read from free'd memory after calling netif_rx(). docopy is used as
> a boolean (0 and 1) so unsigned int is sufficient.
>
> Coverity bug #928
>
> Signed-off-by: Eugene Teo <eugene.teo@eugeneteo.net>
> Cc: "David Miller" <davem@davemloft.net>
> Signed-off-by: Andrew Morton <akpm@osdl.org>
> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
>
> ---
>
> drivers/net/irda/irda-usb.c | 5 +++--
> 1 file changed, 3 insertions(+), 2 deletions(-)
>
> --- linux-2.6.16.1.orig/drivers/net/irda/irda-usb.c
> +++ linux-2.6.16.1/drivers/net/irda/irda-usb.c
> @@ -740,7 +740,7 @@ static void irda_usb_receive(struct urb
> struct sk_buff *newskb;
> struct sk_buff *dataskb;
> struct urb *next_urb;
> - int docopy;
> + unsigned int len, docopy;
>

Is the <docopy> part of the patch just a convenience so that the patch
doesn't have to be split? I don't see this part as critical.

> IRDA_DEBUG(2, "%s(), len=%d\n", __FUNCTION__, urb->actual_length);
>
> @@ -851,10 +851,11 @@ static void irda_usb_receive(struct urb
> dataskb->dev = self->netdev;
> dataskb->mac.raw = dataskb->data;
> dataskb->protocol = htons(ETH_P_IRDA);
> + len = dataskb->len;
> netif_rx(dataskb);
>
> /* Keep stats up to date */
> - self->stats.rx_bytes += dataskb->len;
> + self->stats.rx_bytes += len;
> self->stats.rx_packets++;
> self->netdev->last_rx = jiffies;
>
>

---
~Randy
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
\
 
 \ /
  Last update: 2006-04-05 02:22    [from the cache]
©2003-2010