From 31cd921dea3274202399078443dc6e93ca3f84c1 Mon Sep 17 00:00:00 2001 From: Himangi Saraogi Date: Sat, 21 Jun 2014 20:34:09 +0530 Subject: [PATCH] staging: wlags49_h2: Fix use of skb after netif_rx This patch moves a call to netif_rx(skb) after a subsequent reference to skb, because netif_rx may call kfree_skb via enqueue_to_backlog on its argument. This was found using the following semantic match. // @@ expression skb, e,e1; @@ ( netif_rx(skb); | netif_rx_ni(skb); ) ... when != skb = e ( skb = e1 | * skb ) // Signed-off-by: Himangi Saraogi Acked-by: Julia Lawall Signed-off-by: Greg Kroah-Hartman --- drivers/staging/wlags49_h2/wl_netdev.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/staging/wlags49_h2/wl_netdev.c b/drivers/staging/wlags49_h2/wl_netdev.c index a10d014..60701d43 100644 --- a/drivers/staging/wlags49_h2/wl_netdev.c +++ b/drivers/staging/wlags49_h2/wl_netdev.c @@ -888,8 +888,6 @@ int wl_rx(struct net_device *dev) GET_PACKET(skb->dev, skb, pktlen); if (status == HCF_SUCCESS) { - netif_rx(skb); - if (port == 0) { lp->stats.rx_packets++; lp->stats.rx_bytes += pktlen; @@ -918,6 +916,7 @@ int wl_rx(struct net_device *dev) } #endif /* WIRELESS_SPY */ #endif /* WIRELESS_EXT */ + netif_rx(skb); } else { DBG_ERROR(DbgInfo, "Rx request to card FAILED\n"); -- 2.7.4