diff options
| author | Eric Dumazet <edumazet@google.com> | 2012-06-25 00:45:14 +0000 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2012-06-25 16:30:54 -0700 |
| commit | aa214de0595eecf5079a172a16333fa638b64915 (patch) | |
| tree | 7bfb8c40355c96c01903a83f9ebd546f9bc1b73c /net | |
| parent | 044ca2a5f2f781c7e4b49c7c0a256913648297ea (diff) | |
| download | op-kernel-dev-aa214de0595eecf5079a172a16333fa638b64915.zip op-kernel-dev-aa214de0595eecf5079a172a16333fa638b64915.tar.gz | |
net: l2tp_eth: fix l2tp_eth_dev_xmit race
Its illegal to dereference skb after giving it to l2tp_xmit_skb()
as it might be already freed/reused.
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: James Chapman <jchapman@katalix.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net')
| -rw-r--r-- | net/l2tp/l2tp_eth.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/net/l2tp/l2tp_eth.c b/net/l2tp/l2tp_eth.c index 185f12f..c3738f4 100644 --- a/net/l2tp/l2tp_eth.c +++ b/net/l2tp/l2tp_eth.c @@ -88,12 +88,12 @@ static int l2tp_eth_dev_xmit(struct sk_buff *skb, struct net_device *dev) struct l2tp_eth *priv = netdev_priv(dev); struct l2tp_session *session = priv->session; - l2tp_xmit_skb(session, skb, session->hdr_len); - dev->stats.tx_bytes += skb->len; dev->stats.tx_packets++; - return 0; + l2tp_xmit_skb(session, skb, session->hdr_len); + + return NETDEV_TX_OK; } static struct net_device_ops l2tp_eth_netdev_ops = { |
