summaryrefslogtreecommitdiff
path: root/drivers/net/can/slcan.c
diff options
context:
space:
mode:
authorMarc Kleine-Budde <mkl@pengutronix.de>2015-07-11 22:16:08 +0300
committerMarc Kleine-Budde <mkl@pengutronix.de>2015-07-15 10:04:27 +0300
commita2e78cf7a3f562edca4230b188c8832b6214eccd (patch)
tree6bab018105213b0b70bb2d2d55487074637569ea /drivers/net/can/slcan.c
parent83537b6fd6c3752bcb578d2bd46312d1e2c4a73a (diff)
downloadlinux-a2e78cf7a3f562edca4230b188c8832b6214eccd.tar.xz
can: slcan: don't touch skb after netif_rx_ni()
There is no guarantee that the skb is in the same state after calling net_receive_skb() or netif_rx(). It might be freed or reused. Not really harmful as its a read access, except you turn on the proper debugging options which catch a use after free. Cc: Oliver Hartkopp <socketcan@hartkopp.net> Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Diffstat (limited to 'drivers/net/can/slcan.c')
-rw-r--r--drivers/net/can/slcan.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/net/can/slcan.c b/drivers/net/can/slcan.c
index a23a7af8eb9a..9a3f15cb7ef4 100644
--- a/drivers/net/can/slcan.c
+++ b/drivers/net/can/slcan.c
@@ -218,10 +218,10 @@ static void slc_bump(struct slcan *sl)
memcpy(skb_put(skb, sizeof(struct can_frame)),
&cf, sizeof(struct can_frame));
- netif_rx_ni(skb);
sl->dev->stats.rx_packets++;
sl->dev->stats.rx_bytes += cf.can_dlc;
+ netif_rx_ni(skb);
}
/* parse tty input stream */