[PATCH] Wrong return value corrupts free object in e1000 driver

For some reason, E1000's ->hard_start_xmit() routine returns -EFAULT instead of one of the NETDEV_TX_* error codes. In fact, it frees up the SKB before returning this. This makes the queueing layer think the packet should be requeued and subsequently we corrupt a freed object. Signed-off-by: David S. Miller <[email protected]> Signed-off-by: Jeff Garzik <[email protected]>
progmanos · Mar 11, 2006 · 9e927fb · 9e927fb
1 parent 5ee33b7
commit 9e927fb
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/drivers/net/e1000/e1000_main.c b/drivers/net/e1000/e1000_main.c
@@ -2917,7 +2917,7 @@ e1000_xmit_frame(struct sk_buff *skb, struct net_device *netdev)
 			if (!__pskb_pull_tail(skb, pull_size)) {
 				printk(KERN_ERR "__pskb_pull_tail failed.\n");
 				dev_kfree_skb_any(skb);
-				return -EFAULT;
+				return NETDEV_TX_OK;
 			}
 			len = skb->len - skb->data_len;
 		}