aboutsummaryrefslogtreecommitdiff
path: root/drivers/net
diff options
context:
space:
mode:
authorDavid S. Miller <davem@davemloft.net>2006-03-10 18:08:09 -0800
committerJeff Garzik <jeff@garzik.org>2006-03-11 13:25:17 -0500
commit9e927fb6186b6913d47d33068160088a084d568e (patch)
tree4ecd5584f82fbda06cfe6c162505b59ba4391915 /drivers/net
parent5ee33b7adc178dbeb16b4d8303ae3ab69a334518 (diff)
[PATCH] Wrong return value corrupts free object in e1000 driver
For some reason, E1000's ->hard_start_xmit() routine returns -EFAULT instead of one of the NETDEV_TX_* error codes. In fact, it frees up the SKB before returning this. This makes the queueing layer think the packet should be requeued and subsequently we corrupt a freed object. Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Jeff Garzik <jeff@garzik.org>
Diffstat (limited to 'drivers/net')
-rw-r--r--drivers/net/e1000/e1000_main.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/net/e1000/e1000_main.c b/drivers/net/e1000/e1000_main.c
index 5b7d0f425af..4c4db96d0b7 100644
--- a/drivers/net/e1000/e1000_main.c
+++ b/drivers/net/e1000/e1000_main.c
@@ -2917,7 +2917,7 @@ e1000_xmit_frame(struct sk_buff *skb, struct net_device *netdev)
if (!__pskb_pull_tail(skb, pull_size)) {
printk(KERN_ERR "__pskb_pull_tail failed.\n");
dev_kfree_skb_any(skb);
- return -EFAULT;
+ return NETDEV_TX_OK;
}
len = skb->len - skb->data_len;
}