diff options
| author |   Eric Dumazet <edumazet@google.com> | 2012-07-05 11:45:13 +0000 |
|---|---|---|
| committer |   David S. Miller <davem@davemloft.net> | 2012-07-09 15:28:03 -0700 |
| commit | 313b037cf054ec908de92fb4c085403ffd7420d4 (patch) | |
| tree | 7b7839d50a7d069bc825f58d8f8ad5f2e9a1ad0e /drivers/net/ethernet/freescale/gianfar.c | |
| parent | drivers/net/ethernet/broadcom/cnic.c: remove invalid reference to list iterator variable (diff) | |
| download | linux-dev-313b037cf054ec908de92fb4c085403ffd7420d4.tar.xz linux-dev-313b037cf054ec908de92fb4c085403ffd7420d4.zip | |
gianfar: fix potential sk_wmem_alloc imbalance
commit db83d136d7f753 (gianfar: Fix missing sock reference when
processing TX time stamps) added a potential sk_wmem_alloc imbalance
If the new skb has a different truesize than old one, we can get a
negative sk_wmem_alloc once new skb is orphaned at TX completion.
Now we no longer early orphan skbs in dev_hard_start_xmit(), this
probably can lead to fatal bugs.
Signed-off-by: Eric Dumazet <edumazet@google.com>
Tested-by: Paul Gortmaker <paul.gortmaker@windriver.com>
Cc: Manfred Rudigier <manfred.rudigier@omicron.at>
Cc: Claudiu Manoil <claudiu.manoil@freescale.com>
Cc: Jiajun Wu <b06378@freescale.com>
Cc: Andy Fleming <afleming@freescale.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers/net/ethernet/freescale/gianfar.c')
| -rw-r--r-- | drivers/net/ethernet/freescale/gianfar.c | 7 |
1 files changed, 3 insertions, 4 deletions
diff --git a/drivers/net/ethernet/freescale/gianfar.c b/drivers/net/ethernet/freescale/gianfar.c index f2db8fca46a1..ab1d80ff0791 100644 --- a/drivers/net/ethernet/freescale/gianfar.c +++ b/drivers/net/ethernet/freescale/gianfar.c @@ -2063,10 +2063,9 @@ static int gfar_start_xmit(struct sk_buff *skb, struct net_device *dev) return NETDEV_TX_OK; } - /* Steal sock reference for processing TX time stamps */ - swap(skb_new->sk, skb->sk); - swap(skb_new->destructor, skb->destructor); - kfree_skb(skb); + if (skb->sk) + skb_set_owner_w(skb_new, skb->sk); + consume_skb(skb); skb = skb_new; } |