mirror of
https://git.proxmox.com/git/mirror_ubuntu-kernels.git
synced 2025-12-04 17:34:19 +00:00
6d72e7c767
In emac_mac_tx_buf_send, it calls emac_tx_fill_tpd(..,skb,..).
If some error happens in emac_tx_fill_tpd(), the skb will be freed via
dev_kfree_skb(skb) in error branch of emac_tx_fill_tpd().
But the freed skb is still used via skb->len by netdev_sent_queue(,skb->len).
As i observed that emac_tx_fill_tpd() haven't modified the value of skb->len,
thus my patch assigns skb->len to 'len' before the possible free and
use 'len' instead of skb->len later.
Fixes:
|
||
|---|---|---|
| .. | ||
| emac-ethtool.c | ||
| emac-mac.c | ||
| emac-mac.h | ||
| emac-phy.c | ||
| emac-phy.h | ||
| emac-sgmii-fsm9900.c | ||
| emac-sgmii-qdf2400.c | ||
| emac-sgmii-qdf2432.c | ||
| emac-sgmii.c | ||
| emac-sgmii.h | ||
| emac.c | ||
| emac.h | ||
| Makefile | ||