diff options
| author | David S. Miller <davem@davemloft.net> | 2006-03-10 18:08:09 -0800 |
|---|---|---|
| committer | Jeff Garzik <jeff@garzik.org> | 2006-03-11 13:25:17 -0500 |
| commit | 9e927fb6186b6913d47d33068160088a084d568e (patch) | |
| tree | 4ecd5584f82fbda06cfe6c162505b59ba4391915 | |
| parent | 5ee33b7adc178dbeb16b4d8303ae3ab69a334518 (diff) | |
| download | op-kernel-dev-9e927fb6186b6913d47d33068160088a084d568e.zip op-kernel-dev-9e927fb6186b6913d47d33068160088a084d568e.tar.gz | |
[PATCH] Wrong return value corrupts free object in e1000 driver
For some reason, E1000's ->hard_start_xmit() routine returns -EFAULT
instead of one of the NETDEV_TX_* error codes. In fact, it frees up
the SKB before returning this. This makes the queueing layer think
the packet should be requeued and subsequently we corrupt a freed
object.
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Jeff Garzik <jeff@garzik.org>
| -rw-r--r-- | drivers/net/e1000/e1000_main.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/net/e1000/e1000_main.c b/drivers/net/e1000/e1000_main.c index 5b7d0f4..4c4db96 100644 --- a/drivers/net/e1000/e1000_main.c +++ b/drivers/net/e1000/e1000_main.c @@ -2917,7 +2917,7 @@ e1000_xmit_frame(struct sk_buff *skb, struct net_device *netdev) if (!__pskb_pull_tail(skb, pull_size)) { printk(KERN_ERR "__pskb_pull_tail failed.\n"); dev_kfree_skb_any(skb); - return -EFAULT; + return NETDEV_TX_OK; } len = skb->len - skb->data_len; } |
