Commit 4352d826 authored by Olof Johansson's avatar Olof Johansson Committed by Jeff Garzik

pasemi_mac: Fix reuse of free'd skb

Turns out we're freeing the skb when we detect CRC error, but we're
not clearing out info->skb. We could either clear it and have the stack
reallocate it, or just leave it and the rx ring refill code will reuse
the one that was allocated.

Reusing a freed skb obviously caused some nasty crashes of various kind,
as reported by Brent Baude and David Woodhouse.
Signed-off-by: default avatarOlof Johansson <olof@lixom.net>
Signed-off-by: default avatarJeff Garzik <jeff@garzik.org>
parent d30f53ae
...@@ -586,7 +586,7 @@ static int pasemi_mac_clean_rx(struct pasemi_mac *mac, int limit) ...@@ -586,7 +586,7 @@ static int pasemi_mac_clean_rx(struct pasemi_mac *mac, int limit)
/* CRC error flagged */ /* CRC error flagged */
mac->netdev->stats.rx_errors++; mac->netdev->stats.rx_errors++;
mac->netdev->stats.rx_crc_errors++; mac->netdev->stats.rx_crc_errors++;
dev_kfree_skb_irq(skb); /* No need to free skb, it'll be reused */
goto next; goto next;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment