sgi-xp: fix a use after free
authorEric Dumazet <eric.dumazet@gmail.com>
Sun, 19 Jun 2011 12:52:36 +0000 (12:52 +0000)
committerDavid S. Miller <davem@davemloft.net>
Sun, 19 Jun 2011 23:28:03 +0000 (16:28 -0700)
Its illegal to dereference skb after dev_kfree_skb(skb)

Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
CC: Robin Holt <holt@sgi.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
drivers/misc/sgi-xp/xpnet.c

index ee5109a3cd984f287c824fd71d3221ead361bccd..42f067347bc70fd8f24466ed4384408191812611 100644 (file)
@@ -495,14 +495,14 @@ xpnet_dev_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
                }
        }
 
+       dev->stats.tx_packets++;
+       dev->stats.tx_bytes += skb->len;
+
        if (atomic_dec_return(&queued_msg->use_count) == 0) {
                dev_kfree_skb(skb);
                kfree(queued_msg);
        }
 
-       dev->stats.tx_packets++;
-       dev->stats.tx_bytes += skb->len;
-
        return NETDEV_TX_OK;
 }