diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2017-04-22 13:46:56 +0300 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2017-04-24 20:58:49 +0300 |
| commit | 9199cb7677b388b42e3d95c755090dfc5ab2b11a (patch) | |
| tree | 54b0803b91ac40300508aad3a0fb08c57d69fa9a /drivers/net/ethernet/renesas/ravb_main.c | |
| parent | b40c5f4fde22fb98eff205b3aece05b471c24eed (diff) | |
| download | linux-9199cb7677b388b42e3d95c755090dfc5ab2b11a.tar.xz | |
ravb: Double free on error in ravb_start_xmit()
If skb_put_padto() fails then it frees the skb. I shifted that code
up a bit to make my error handling a little simpler.
Fixes: a0d2f20650e8 ("Renesas Ethernet AVB PTP clock driver")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers/net/ethernet/renesas/ravb_main.c')
| -rw-r--r-- | drivers/net/ethernet/renesas/ravb_main.c | 7 |
1 files changed, 4 insertions, 3 deletions
diff --git a/drivers/net/ethernet/renesas/ravb_main.c b/drivers/net/ethernet/renesas/ravb_main.c index 8cfc4a54f2dc..3cd7989c007d 100644 --- a/drivers/net/ethernet/renesas/ravb_main.c +++ b/drivers/net/ethernet/renesas/ravb_main.c @@ -1516,11 +1516,12 @@ static netdev_tx_t ravb_start_xmit(struct sk_buff *skb, struct net_device *ndev) spin_unlock_irqrestore(&priv->lock, flags); return NETDEV_TX_BUSY; } - entry = priv->cur_tx[q] % (priv->num_tx_ring[q] * NUM_TX_DESC); - priv->tx_skb[q][entry / NUM_TX_DESC] = skb; if (skb_put_padto(skb, ETH_ZLEN)) - goto drop; + goto exit; + + entry = priv->cur_tx[q] % (priv->num_tx_ring[q] * NUM_TX_DESC); + priv->tx_skb[q][entry / NUM_TX_DESC] = skb; buffer = PTR_ALIGN(priv->tx_align[q], DPTR_ALIGN) + entry / NUM_TX_DESC * DPTR_ALIGN; |