pasemi_mac: Fix reuse of free'd skb
Turns out we're freeing the skb when we detect CRC error, but we're not clearing out info->skb. We could either clear it and have the stack reallocate it, or just leave it and the rx ring refill code will reuse the one that was allocated. Reusing a freed skb obviously caused some nasty crashes of various kind, as reported by Brent Baude and David Woodhouse. Signed-off-by: Olof Johansson <olof@lixom.net> Signed-off-by: Jeff Garzik <jeff@garzik.org>
This commit is contained in:
parent
d30f53aeb3
commit
4352d82647
|
@ -586,7 +586,7 @@ static int pasemi_mac_clean_rx(struct pasemi_mac *mac, int limit)
|
|||
/* CRC error flagged */
|
||||
mac->netdev->stats.rx_errors++;
|
||||
mac->netdev->stats.rx_crc_errors++;
|
||||
dev_kfree_skb_irq(skb);
|
||||
/* No need to free skb, it'll be reused */
|
||||
goto next;
|
||||
}
|
||||
|
||||
|
|
Loading…
Reference in New Issue