s390/qeth: don't access skb after transmission
authorJulian Wiedmann <jwi@linux.vnet.ibm.com>
Tue, 15 Aug 2017 15:02:39 +0000 (17:02 +0200)
committerDavid S. Miller <davem@davemloft.net>
Tue, 15 Aug 2017 17:58:39 +0000 (10:58 -0700)
commit886e1974dcc5866cbc3d133d1f3d2cc26af68cfc
tree0910a1aef5b8ae49d8f1db49c5aa2fca4d46f3a1
parentd396179c166932e51b3a65c4f766671ac4e48763
s390/qeth: don't access skb after transmission

After transmitting a skb via send_packet[_fast](), the statistics
code accesses the skb once more to account for transmitted page frags.
This has a (theoretical?) race against the TX completion - if the TX
completion is processed and frees the skb before hard_start_xmit()
gets to the statistics part, we access random memory.

Fix this by caching the # of page frags, before the skb is transmitted.

Signed-off-by: Julian Wiedmann <jwi@linux.vnet.ibm.com>
Acked-by: Ursula Braun <ubraun@linux.vnet.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
drivers/s390/net/qeth_l2_main.c
drivers/s390/net/qeth_l3_main.c