[Xen-changelog] [linux-2.6.18-xen] net front: Avoid deref'ing skb after it is potentially freed.

["Xen patchbot-linux-2.6.18-xen" <patchbot-linux-2.6.18-xen@xxxxxxxxxxxxxxxxxxx>]

# HG changeset patch
# User kfraser@xxxxxxxxxxxxxxxxxxxxx
# Date 1187004079 -3600
# Node ID 877c2e42a701d6a32ca30f35da34ade0b935f820
# Parent  d2f9b7e3623114e6a45c916f21b348fda122fa8e
net front: Avoid deref'ing skb after it is potentially freed.
Signed-off-by: Keir Fraser <keir@xxxxxxxxxxxxx>
---
 drivers/xen/netfront/netfront.c |    7 ++++---
 1 files changed, 4 insertions(+), 3 deletions(-)

diff -r d2f9b7e36231 -r 877c2e42a701 drivers/xen/netfront/netfront.c
--- a/drivers/xen/netfront/netfront.c   Thu Aug 09 16:16:28 2007 +0100
+++ b/drivers/xen/netfront/netfront.c   Mon Aug 13 12:21:19 2007 +0100
@@ -1013,15 +1013,16 @@ static int network_start_xmit(struct sk_
        if (notify)
                notify_remote_via_irq(np->irq);
 
+       np->stats.tx_bytes += skb->len;
+       np->stats.tx_packets++;
+
+       /* Note: It is not safe to access skb after network_tx_buf_gc()! */
        network_tx_buf_gc(dev);
 
        if (!netfront_tx_slot_available(np))
                netif_stop_queue(dev);
 
        spin_unlock_irq(&np->tx_lock);
-
-       np->stats.tx_bytes += skb->len;
-       np->stats.tx_packets++;
 
        return 0;
 

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-changelog