| From 8825e544269d30724022625eac0fa4ccc0cacca1 Mon Sep 17 00:00:00 2001 |
| From: Dan Carpenter <dan.carpenter@oracle.com> |
| Date: Sat, 22 Apr 2017 13:46:56 +0300 |
| Subject: [PATCH 219/255] ravb: Double free on error in ravb_start_xmit() |
| |
| If skb_put_padto() fails then it frees the skb. I shifted that code |
| up a bit to make my error handling a little simpler. |
| |
| Fixes: a0d2f20650e8 ("Renesas Ethernet AVB PTP clock driver") |
| Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> |
| Acked-by: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com> |
| Signed-off-by: David S. Miller <davem@davemloft.net> |
| (cherry picked from commit 9199cb7677b388b42e3d95c755090dfc5ab2b11a) |
| Signed-off-by: Simon Horman <horms+renesas@verge.net.au> |
| --- |
| drivers/net/ethernet/renesas/ravb_main.c | 7 ++++--- |
| 1 file changed, 4 insertions(+), 3 deletions(-) |
| |
| --- a/drivers/net/ethernet/renesas/ravb_main.c |
| +++ b/drivers/net/ethernet/renesas/ravb_main.c |
| @@ -1492,11 +1492,12 @@ static netdev_tx_t ravb_start_xmit(struc |
| spin_unlock_irqrestore(&priv->lock, flags); |
| return NETDEV_TX_BUSY; |
| } |
| - entry = priv->cur_tx[q] % (priv->num_tx_ring[q] * NUM_TX_DESC); |
| - priv->tx_skb[q][entry / NUM_TX_DESC] = skb; |
| |
| if (skb_put_padto(skb, ETH_ZLEN)) |
| - goto drop; |
| + goto exit; |
| + |
| + entry = priv->cur_tx[q] % (priv->num_tx_ring[q] * NUM_TX_DESC); |
| + priv->tx_skb[q][entry / NUM_TX_DESC] = skb; |
| |
| buffer = PTR_ALIGN(priv->tx_align[q], DPTR_ALIGN) + |
| entry / NUM_TX_DESC * DPTR_ALIGN; |