From 16e07dbd197fb08916b7807683321d60a6332e5a Mon Sep 17 00:00:00 2001 From: Noam Camus Date: Thu, 20 Aug 2015 08:00:02 +0300 Subject: [PATCH] NET: nps_enet: TX done race condition We need to set tx_skb pointer before send frame. If we receive interrupt before we set pointer we will try to free SKB with wrong pointer. Now we are sure that SKB pointer will never be NULL during handling TX done and check is removed. Signed-off-by: Noam Camus Signed-off-by: David S. Miller --- drivers/net/ethernet/ezchip/nps_enet.c | 10 +++------- 1 file changed, 3 insertions(+), 7 deletions(-) diff --git a/drivers/net/ethernet/ezchip/nps_enet.c b/drivers/net/ethernet/ezchip/nps_enet.c index 0e652b4fee8d6..8b25f240943d9 100644 --- a/drivers/net/ethernet/ezchip/nps_enet.c +++ b/drivers/net/ethernet/ezchip/nps_enet.c @@ -158,11 +158,7 @@ static void nps_enet_tx_handler(struct net_device *ndev) ndev->stats.tx_bytes += tx_ctrl.nt; } - if (priv->tx_skb) { - dev_kfree_skb(priv->tx_skb); - priv->tx_skb = NULL; - } - + dev_kfree_skb(priv->tx_skb); priv->tx_packet_sent = false; if (netif_queue_stopped(ndev)) @@ -528,10 +524,10 @@ static netdev_tx_t nps_enet_start_xmit(struct sk_buff *skb, /* This driver handles one frame at a time */ netif_stop_queue(ndev); - nps_enet_send_frame(ndev, skb); - priv->tx_skb = skb; + nps_enet_send_frame(ndev, skb); + return NETDEV_TX_OK; } -- 2.39.5