sgi-xp: fix a use after free

Its illegal to dereference skb after dev_kfree_skb(skb)

Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
CC: Robin Holt <holt@sgi.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/drivers/misc/sgi-xp/xpnet.c b/drivers/misc/sgi-xp/xpnet.c
index ee5109a3cd984f287c824fd71d3221ead361bccd..42f067347bc70fd8f24466ed4384408191812611 100644 (file)
--- a/drivers/misc/sgi-xp/xpnet.c
+++ b/drivers/misc/sgi-xp/xpnet.c
@@ -495,14 +495,14 @@ xpnet_dev_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
                }
        }
 
+       dev->stats.tx_packets++;
+       dev->stats.tx_bytes += skb->len;
+
        if (atomic_dec_return(&queued_msg->use_count) == 0) {
                dev_kfree_skb(skb);
                kfree(queued_msg);
        }
 
-       dev->stats.tx_packets++;
-       dev->stats.tx_bytes += skb->len;
-
        return NETDEV_TX_OK;
 }