dect
/
linux-2.6
Archived
13
0
Fork 0
Code Releases Activity

[PATCH] Wrong return value corrupts free object in e1000 driver 

For some reason, E1000's ->hard_start_xmit() routine returns -EFAULT
instead of one of the NETDEV_TX_* error codes.  In fact, it frees up
the SKB before returning this.  This makes the queueing layer think
the packet should be requeued and subsequently we corrupt a freed
object.

Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Jeff Garzik <jeff@garzik.org>
This commit is contained in:
David S. Miller 2006-03-10 18:08:09 -08:00 committed by Jeff Garzik
parent 5ee33b7adc
commit 9e927fb618
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
drivers/net/e1000/e1000_main.c
View File

@ -2917,7 +2917,7 @@ e1000_xmit_frame(struct sk_buff *skb, struct net_device *netdev)
if (!__pskb_pull_tail(skb, pull_size)) {
printk(KERN_ERR "__pskb_pull_tail failed.\n");
dev_kfree_skb_any(skb);
return -EFAULT;
return NETDEV_TX_OK;
}
len = skb->len - skb->data_len;
}