From 98ca4a46d27348476c9196ebc0a0c5297431d90f Mon Sep 17 00:00:00 2001
From: Patrick McHardy <kaber@trash.net>
Date: Fri, 12 Jun 2009 05:20:01 +0000
Subject: [PATCH] net: fix network drivers ndo_start_xmit() return values (part
6)
Fix up hamradio drivers that return an errno value to dev_queue_xmit(), causing
it to print a warning an free the skb.
- bpqether: skb is freed: use after free
Compile tested only.
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
---
drivers/net/hamradio/bpqether.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/net/hamradio/bpqether.c b/drivers/net/hamradio/bpqether.c
index d509b371a562..5105548ad50c 100644
--- a/drivers/net/hamradio/bpqether.c
+++ b/drivers/net/hamradio/bpqether.c
@@ -274,7 +274,7 @@ static int bpq_xmit(struct sk_buff *skb, struct net_device *dev)
if ((newskb = skb_realloc_headroom(skb, AX25_BPQ_HEADER_LEN)) == NULL) {
printk(KERN_WARNING "bpqether: out of memory\n");
kfree_skb(skb);
- return -ENOMEM;
+ return NETDEV_TX_OK;
}
if (skb->sk != NULL)
@@ -294,7 +294,7 @@ static int bpq_xmit(struct sk_buff *skb, struct net_device *dev)
if ((dev = bpq_get_ether_dev(dev)) == NULL) {
dev->stats.tx_dropped++;
kfree_skb(skb);
- return -ENODEV;
+ return NETDEV_TX_OK;
}
skb->protocol = ax25_type_trans(skb, dev);
--
GitLab