[PATCH] Use after free in net/tulip/de2104x.c

hi,

this fixes coverity bug #912, where skb is freed first,
and dereferenced a few lines later with skb->len.

Signed-off-by: Eric Sesterhenn <snakebyte@gmx.de>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

1 files changed, 1 insertions, 1 deletions

diff --git a/drivers/net/tulip/de2104x.c b/drivers/net/tulip/de2104x.c
index 6299e186c73f..e3dd144d326b 100644
--- a/drivers/net/tulip/de2104x.c
+++ b/drivers/net/tulip/de2104x.c
@@ -1327,11 +1327,11 @@ static void de_clean_rings (struct de_private *de)
                 struct sk_buff *skb = de->tx_skb[i].skb;
                 if ((skb) && (skb != DE_DUMMY_SKB)) {
                         if (skb != DE_SETUP_SKB) {
-                                dev_kfree_skb(skb);
                                 de->net_stats.tx_dropped++;
                                 pci_unmap_single(de->pdev,
                                         de->tx_skb[i].mapping,
                                         skb->len, PCI_DMA_TODEVICE);
+                                dev_kfree_skb(skb);
                         } else {
                                 pci_unmap_single(de->pdev,
                                         de->tx_skb[i].mapping,