NET: nps_enet: TX done race condition
authorNoam Camus <noamc@ezchip.com>
Thu, 20 Aug 2015 05:00:02 +0000 (08:00 +0300)
committerDavid S. Miller <davem@davemloft.net>
Sun, 23 Aug 2015 23:08:53 +0000 (16:08 -0700)
We need to set tx_skb pointer before send frame.
If we receive interrupt before we set pointer we will try
to free SKB with wrong pointer.
Now we are sure that SKB pointer will never be NULL during
handling TX done and check is removed.

Signed-off-by: Noam Camus <noamc@ezchip.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
drivers/net/ethernet/ezchip/nps_enet.c

index 0e652b4fee8d6c235d94bc1370eea094234d2d50..8b25f240943d93fd1a47738a820db28bda35bf77 100644 (file)
@@ -158,11 +158,7 @@ static void nps_enet_tx_handler(struct net_device *ndev)
                ndev->stats.tx_bytes += tx_ctrl.nt;
        }
 
-       if (priv->tx_skb) {
-               dev_kfree_skb(priv->tx_skb);
-               priv->tx_skb = NULL;
-       }
-
+       dev_kfree_skb(priv->tx_skb);
        priv->tx_packet_sent = false;
 
        if (netif_queue_stopped(ndev))
@@ -528,10 +524,10 @@ static netdev_tx_t nps_enet_start_xmit(struct sk_buff *skb,
        /* This driver handles one frame at a time  */
        netif_stop_queue(ndev);
 
-       nps_enet_send_frame(ndev, skb);
-
        priv->tx_skb = skb;
 
+       nps_enet_send_frame(ndev, skb);
+
        return NETDEV_TX_OK;
 }