aboutsummaryrefslogtreecommitdiff
path: root/drivers
diff options
context:
space:
mode:
authorEric Sesterhenn <snakebyte@gmx.de>2006-03-22 22:30:34 +0100
committerJeff Garzik <jeff@garzik.org>2006-03-22 20:30:45 -0500
commit5185c7c20a4b88892f868ad8d92d1b640b1edba9 (patch)
tree53674f28e6dd666a59f5495f73149736ec260505 /drivers
parent494aced2cda34c186083f7d53c419426eea3d584 (diff)
[PATCH] Use after free in net/tulip/de2104x.c
hi, this fixes coverity bug #912, where skb is freed first, and dereferenced a few lines later with skb->len. Signed-off-by: Eric Sesterhenn <snakebyte@gmx.de> Signed-off-by: Jeff Garzik <jeff@garzik.org>
Diffstat (limited to 'drivers')
-rw-r--r--drivers/net/tulip/de2104x.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/net/tulip/de2104x.c b/drivers/net/tulip/de2104x.c
index 6299e186c73..e3dd144d326 100644
--- a/drivers/net/tulip/de2104x.c
+++ b/drivers/net/tulip/de2104x.c
@@ -1327,11 +1327,11 @@ static void de_clean_rings (struct de_private *de)
struct sk_buff *skb = de->tx_skb[i].skb;
if ((skb) && (skb != DE_DUMMY_SKB)) {
if (skb != DE_SETUP_SKB) {
- dev_kfree_skb(skb);
de->net_stats.tx_dropped++;
pci_unmap_single(de->pdev,
de->tx_skb[i].mapping,
skb->len, PCI_DMA_TODEVICE);
+ dev_kfree_skb(skb);
} else {
pci_unmap_single(de->pdev,
de->tx_skb[i].mapping,