xen-netfront: Avoid deref'ing skbafter it is potentially freed.

xennet_tx_bug_gc can free the skb before we use it, so make sure we don't.

Signed-off-by: Keir Fraser <keir@xensource.com>
Signed-off-by: Jeremy Fitzhardinge <jeremy@xensource.com>
Cc: Jeff Garzik <jeff@garzik.org>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

1 files changed, 4 insertions, 3 deletions

diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c
index 489f69c5d6ca..4445810335a8 100644
--- a/drivers/net/xen-netfront.c
+++ b/drivers/net/xen-netfront.c
@@ -566,6 +566,10 @@ static int xennet_start_xmit(struct sk_buff *skb, struct net_device *dev)
         if (notify)
                 notify_remote_via_irq(np->netdev->irq);
 
+        np->stats.tx_bytes += skb->len;
+        np->stats.tx_packets++;
+
+        /* Note: It is not safe to access skb after xennet_tx_buf_gc()! */
         xennet_tx_buf_gc(dev);
 
         if (!netfront_tx_slot_available(np))
@@ -573,9 +577,6 @@ static int xennet_start_xmit(struct sk_buff *skb, struct net_device *dev)
 
         spin_unlock_irq(&np->tx_lock);
 
-        np->stats.tx_bytes += skb->len;
-        np->stats.tx_packets++;
-
         return 0;
 
  drop: