diff options
| author |   Eric Dumazet <eric.dumazet@gmail.com> | 2010-08-18 00:24:43 +0000 |
|---|---|---|
| committer |   David S. Miller <davem@davemloft.net> | 2010-08-19 00:41:52 -0700 |
| commit | 79c5f51c639021f7472591239c3867cee4b9ec02 (patch) | |
| tree | d7aeb85577fdb66ab2f4682778e135f263cadb6a | |
| parent | net: sh_eth: remove unused variable (diff) | |
| download | linux-dev-79c5f51c639021f7472591239c3867cee4b9ec02.tar.xz linux-dev-79c5f51c639021f7472591239c3867cee4b9ec02.zip | |
irda: fix a race in irlan_eth_xmit()
After skb is queued, its illegal to dereference it.
Cache skb->len into a temporary variable.
Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
| -rw-r--r-- | net/irda/irlan/irlan_eth.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/net/irda/irlan/irlan_eth.c b/net/irda/irlan/irlan_eth.c index 9616c32d1076..5bb8353105cc 100644 --- a/net/irda/irlan/irlan_eth.c +++ b/net/irda/irlan/irlan_eth.c @@ -169,6 +169,7 @@ static netdev_tx_t irlan_eth_xmit(struct sk_buff *skb, { struct irlan_cb *self = netdev_priv(dev); int ret; + unsigned int len; /* skb headroom large enough to contain all IrDA-headers? */ if ((skb_headroom(skb) < self->max_header_size) || (skb_shared(skb))) { @@ -188,6 +189,7 @@ static netdev_tx_t irlan_eth_xmit(struct sk_buff *skb, dev->trans_start = jiffies; + len = skb->len; /* Now queue the packet in the transport layer */ if (self->use_udata) ret = irttp_udata_request(self->tsap_data, skb); @@ -209,7 +211,7 @@ static netdev_tx_t irlan_eth_xmit(struct sk_buff *skb, self->stats.tx_dropped++; } else { self->stats.tx_packets++; - self->stats.tx_bytes += skb->len; + self->stats.tx_bytes += len; } return NETDEV_TX_OK; |