From: Eric Sesterhenn <snakebyte@gmx.de>
Date: Wed, 22 Mar 2006 21:30:34 +0000 (+0100)
Subject: [PATCH] Use after free in net/tulip/de2104x.c
X-Git-Url: https://git.stricted.de/?a=commitdiff_plain;h=5185c7c20a4b88892f868ad8d92d1b640b1edba9;p=GitHub%2FLineageOS%2FG12%2Fandroid_kernel_amlogic_linux-4.9.git

[PATCH] Use after free in net/tulip/de2104x.c

hi,

this fixes coverity bug #912, where skb is freed first,
and dereferenced a few lines later with skb->len.

Signed-off-by: Eric Sesterhenn <snakebyte@gmx.de>
Signed-off-by: Jeff Garzik <jeff@garzik.org>
---

diff --git a/drivers/net/tulip/de2104x.c b/drivers/net/tulip/de2104x.c
index 6299e186c73f..e3dd144d326b 100644
--- a/drivers/net/tulip/de2104x.c
+++ b/drivers/net/tulip/de2104x.c
@@ -1327,11 +1327,11 @@ static void de_clean_rings (struct de_private *de)
 		struct sk_buff *skb = de->tx_skb[i].skb;
 		if ((skb) && (skb != DE_DUMMY_SKB)) {
 			if (skb != DE_SETUP_SKB) {
-				dev_kfree_skb(skb);
 				de->net_stats.tx_dropped++;
 				pci_unmap_single(de->pdev,
 					de->tx_skb[i].mapping,
 					skb->len, PCI_DMA_TODEVICE);
+				dev_kfree_skb(skb);
 			} else {
 				pci_unmap_single(de->pdev,
 					de->tx_skb[i].mapping,