tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

[PATCH] Wrong return value corrupts free object in e1000 driver

For some reason, E1000's ->hard_start_xmit() routine returns -EFAULT
instead of one of the NETDEV_TX_* error codes. In fact, it frees up
the SKB before returning this. This makes the queueing layer think
the packet should be requeued and subsequently we corrupt a freed
object.

Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

authored by

David S. Miller and committed by
Jeff Garzik 9e927fb6 5ee33b7a

+1 -1
+1 -1
drivers/net/e1000/e1000_main.c
··· 2917 2917 if (!__pskb_pull_tail(skb, pull_size)) { 2918 2918 printk(KERN_ERR "__pskb_pull_tail failed.\n"); 2919 2919 dev_kfree_skb_any(skb); 2920 - return -EFAULT; 2920 + return NETDEV_TX_OK; 2921 2921 } 2922 2922 len = skb->len - skb->data_len; 2923 2923 }