From: Eric Dumazet <edumazet@google.com>
Date: Mon, 25 Jun 2012 00:45:14 +0000 (+0000)
Subject: net: l2tp_eth: fix l2tp_eth_dev_xmit race
X-Git-Url: https://git.stricted.de/?a=commitdiff_plain;h=aa214de0595eecf5079a172a16333fa638b64915;p=GitHub%2Fexynos8895%2Fandroid_kernel_samsung_universal8895.git

net: l2tp_eth: fix l2tp_eth_dev_xmit race

Its illegal to dereference skb after giving it to l2tp_xmit_skb()
as it might be already freed/reused.

Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: James Chapman <jchapman@katalix.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
---

diff --git a/net/l2tp/l2tp_eth.c b/net/l2tp/l2tp_eth.c
index 185f12f4a5fa..c3738f49646a 100644
--- a/net/l2tp/l2tp_eth.c
+++ b/net/l2tp/l2tp_eth.c
@@ -88,12 +88,12 @@ static int l2tp_eth_dev_xmit(struct sk_buff *skb, struct net_device *dev)
 	struct l2tp_eth *priv = netdev_priv(dev);
 	struct l2tp_session *session = priv->session;
 
-	l2tp_xmit_skb(session, skb, session->hdr_len);
-
 	dev->stats.tx_bytes += skb->len;
 	dev->stats.tx_packets++;
 
-	return 0;
+	l2tp_xmit_skb(session, skb, session->hdr_len);
+
+	return NETDEV_TX_OK;
 }
 
 static struct net_device_ops l2tp_eth_netdev_ops = {