diff options
Diffstat (limited to 'tags/2.6.22-2/20037_157-netfront-skb-deref.patch1')
| -rw-r--r-- | tags/2.6.22-2/20037_157-netfront-skb-deref.patch1 | 35 |
1 files changed, 35 insertions, 0 deletions
diff --git a/tags/2.6.22-2/20037_157-netfront-skb-deref.patch1 b/tags/2.6.22-2/20037_157-netfront-skb-deref.patch1 new file mode 100644 index 0000000..5f6b822 --- /dev/null +++ b/tags/2.6.22-2/20037_157-netfront-skb-deref.patch1 @@ -0,0 +1,35 @@ +# HG changeset 157 patch +# User kfraser@localhost.localdomain +# Date 1187004079 -3600 +# Node ID 877c2e42a701d6a32ca30f35da34ade0b935f820 +# Parent d2f9b7e3623114e6a45c916f21b348fda122fa8e +Subject: net front: Avoid deref'ing skb after it is potentially freed. +Signed-off-by: Keir Fraser <keir@xensource.com> + +Acked-by: jbeulich@novell.com + +Index: head-2007-08-22/drivers/xen/netfront/netfront.c +=================================================================== +--- head-2007-08-22.orig/drivers/xen/netfront/netfront.c 2007-08-22 09:52:40.000000000 +0200 ++++ head-2007-08-22/drivers/xen/netfront/netfront.c 2007-08-22 09:52:45.000000000 +0200 +@@ -1015,6 +1015,10 @@ static int network_start_xmit(struct sk_ + if (notify) + notify_remote_via_irq(np->irq); + ++ np->stats.tx_bytes += skb->len; ++ np->stats.tx_packets++; ++ ++ /* Note: It is not safe to access skb after network_tx_buf_gc()! */ + network_tx_buf_gc(dev); + + if (!netfront_tx_slot_available(np)) +@@ -1022,9 +1026,6 @@ static int network_start_xmit(struct sk_ + + spin_unlock_irq(&np->tx_lock); + +- np->stats.tx_bytes += skb->len; +- np->stats.tx_packets++; +- + return 0; + + drop: |