From: Olof Johansson Date: Tue, 4 Dec 2007 03:34:14 +0000 (-0600) Subject: pasemi_mac: Fix reuse of free'd skb X-Git-Tag: v2.6.24-rc5~106^2~2 X-Git-Url: https://err.no/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=4352d82647f679fb8dd9440b34400fa49beedb2c;p=linux-2.6 pasemi_mac: Fix reuse of free'd skb Turns out we're freeing the skb when we detect CRC error, but we're not clearing out info->skb. We could either clear it and have the stack reallocate it, or just leave it and the rx ring refill code will reuse the one that was allocated. Reusing a freed skb obviously caused some nasty crashes of various kind, as reported by Brent Baude and David Woodhouse. Signed-off-by: Olof Johansson Signed-off-by: Jeff Garzik --- diff --git a/drivers/net/pasemi_mac.c b/drivers/net/pasemi_mac.c index a8db5d7105..816a59e801 100644 --- a/drivers/net/pasemi_mac.c +++ b/drivers/net/pasemi_mac.c @@ -586,7 +586,7 @@ static int pasemi_mac_clean_rx(struct pasemi_mac *mac, int limit) /* CRC error flagged */ mac->netdev->stats.rx_errors++; mac->netdev->stats.rx_crc_errors++; - dev_kfree_skb_irq(skb); + /* No need to free skb, it'll be reused */ goto next; }