mirror of
https://git.proxmox.com/git/mirror_ubuntu-kernels.git
synced 2025-12-31 19:12:52 +00:00
85aec73d59
If build_skb fails the memory associated with the ring buffer is freed but the ri->data member is not zeroed in this case. This causes a double-free of this memory in tg3_free_rings->... path. The patch moves this block after setting ri->data to NULL. It would be nice to fix this bug also in stable >= v3.4 trees. Cc: Nithin Nayak Sujir <nsujir@broadcom.com> Cc: Michael Chan <mchan@broadcom.com> Signed-off-by: Ivan Vecera <ivecera@redhat.com> Acked-by: Michael Chan <mchan@broadcom.com> Signed-off-by: David S. Miller <davem@davemloft.net> |
||
|---|---|---|
| .. | ||
| bnx2x | ||
| b44.c | ||
| b44.h | ||
| bcm63xx_enet.c | ||
| bcm63xx_enet.h | ||
| bgmac.c | ||
| bgmac.h | ||
| bnx2_fw.h | ||
| bnx2.c | ||
| bnx2.h | ||
| cnic_defs.h | ||
| cnic_if.h | ||
| cnic.c | ||
| cnic.h | ||
| Kconfig | ||
| Makefile | ||
| sb1250-mac.c | ||
| tg3.c | ||
| tg3.h | ||