summaryrefslogtreecommitdiff
path: root/net/l2tp
diff options
context:
space:
mode:
authorEric Dumazet <edumazet@google.com>2012-06-25 00:45:14 +0000
committerDavid S. Miller <davem@davemloft.net>2012-06-25 16:30:54 -0700
commitaa214de0595eecf5079a172a16333fa638b64915 (patch)
tree7bfb8c40355c96c01903a83f9ebd546f9bc1b73c /net/l2tp
parent044ca2a5f2f781c7e4b49c7c0a256913648297ea (diff)
net: l2tp_eth: fix l2tp_eth_dev_xmit race
Its illegal to dereference skb after giving it to l2tp_xmit_skb() as it might be already freed/reused. Signed-off-by: Eric Dumazet <edumazet@google.com> Cc: James Chapman <jchapman@katalix.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/l2tp')
-rw-r--r--net/l2tp/l2tp_eth.c6
1 files changed, 3 insertions, 3 deletions
diff --git a/net/l2tp/l2tp_eth.c b/net/l2tp/l2tp_eth.c
index 185f12f4a5fa..c3738f49646a 100644
--- a/net/l2tp/l2tp_eth.c
+++ b/net/l2tp/l2tp_eth.c
@@ -88,12 +88,12 @@ static int l2tp_eth_dev_xmit(struct sk_buff *skb, struct net_device *dev)
struct l2tp_eth *priv = netdev_priv(dev);
struct l2tp_session *session = priv->session;
- l2tp_xmit_skb(session, skb, session->hdr_len);
-
dev->stats.tx_bytes += skb->len;
dev->stats.tx_packets++;
- return 0;
+ l2tp_xmit_skb(session, skb, session->hdr_len);
+
+ return NETDEV_TX_OK;
}
static struct net_device_ops l2tp_eth_netdev_ops = {