hollalinux
/
linux-sg2042
mirror of https://github.com/sophgo/linux-riscv.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

[PATCH] Use after free in net/tulip/de2104x.c 

hi,

this fixes coverity bug #912, where skb is freed first,
and dereferenced a few lines later with skb->len.

Signed-off-by: Eric Sesterhenn <snakebyte@gmx.de>
Signed-off-by: Jeff Garzik <jeff@garzik.org>
This commit is contained in:
Eric Sesterhenn 2006-03-22 22:30:34 +01:00 committed by Jeff Garzik
parent 494aced2cd
commit 5185c7c20a
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
drivers/net/tulip/de2104x.c
View File

@ -1327,11 +1327,11 @@ static void de_clean_rings (struct de_private *de)
struct sk_buff *skb = de->tx_skb[i].skb; struct sk_buff *skb = de->tx_skb[i].skb;
if ((skb) && (skb != DE_DUMMY_SKB)) { if ((skb) && (skb != DE_DUMMY_SKB)) {
if (skb != DE_SETUP_SKB) { if (skb != DE_SETUP_SKB) {
dev_kfree_skb(skb);
de->net_stats.tx_dropped++; de->net_stats.tx_dropped++;
pci_unmap_single(de->pdev, pci_unmap_single(de->pdev,
de->tx_skb[i].mapping, de->tx_skb[i].mapping,
skb->len, PCI_DMA_TODEVICE); skb->len, PCI_DMA_TODEVICE);
dev_kfree_skb(skb);
} else { } else {
pci_unmap_single(de->pdev, pci_unmap_single(de->pdev,
de->tx_skb[i].mapping, de->tx_skb[i].mapping,