aboutsummaryrefslogtreecommitdiffstats
path: root/drivers/net/tulip
diff options
context:
space:
mode:
authorEric Sesterhenn <snakebyte@gmx.de>2006-03-22 16:30:34 -0500
committerJeff Garzik <jeff@garzik.org>2006-03-22 20:30:45 -0500
commit5185c7c20a4b88892f868ad8d92d1b640b1edba9 (patch)
tree53674f28e6dd666a59f5495f73149736ec260505 /drivers/net/tulip
parent494aced2cda34c186083f7d53c419426eea3d584 (diff)
[PATCH] Use after free in net/tulip/de2104x.c
hi, this fixes coverity bug #912, where skb is freed first, and dereferenced a few lines later with skb->len. Signed-off-by: Eric Sesterhenn <snakebyte@gmx.de> Signed-off-by: Jeff Garzik <jeff@garzik.org>
Diffstat (limited to 'drivers/net/tulip')
-rw-r--r--drivers/net/tulip/de2104x.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/net/tulip/de2104x.c b/drivers/net/tulip/de2104x.c
index 6299e186c73f..e3dd144d326b 100644
--- a/drivers/net/tulip/de2104x.c
+++ b/drivers/net/tulip/de2104x.c
@@ -1327,11 +1327,11 @@ static void de_clean_rings (struct de_private *de)
1327 struct sk_buff *skb = de->tx_skb[i].skb; 1327 struct sk_buff *skb = de->tx_skb[i].skb;
1328 if ((skb) && (skb != DE_DUMMY_SKB)) { 1328 if ((skb) && (skb != DE_DUMMY_SKB)) {
1329 if (skb != DE_SETUP_SKB) { 1329 if (skb != DE_SETUP_SKB) {
1330 dev_kfree_skb(skb);
1331 de->net_stats.tx_dropped++; 1330 de->net_stats.tx_dropped++;
1332 pci_unmap_single(de->pdev, 1331 pci_unmap_single(de->pdev,
1333 de->tx_skb[i].mapping, 1332 de->tx_skb[i].mapping,
1334 skb->len, PCI_DMA_TODEVICE); 1333 skb->len, PCI_DMA_TODEVICE);
1334 dev_kfree_skb(skb);
1335 } else { 1335 } else {
1336 pci_unmap_single(de->pdev, 1336 pci_unmap_single(de->pdev,
1337 de->tx_skb[i].mapping, 1337 de->tx_skb[i].mapping,