On Mon, Dec 14, 2020 at 01:08:32PM -0800, Jakub Kicinski wrote:
> On Mon, 14 Dec 2020 11:03:12 +0100 Julian Wiedmann wrote:
> > > diff --git a/drivers/net/ethernet/korina.c b/drivers/net/ethernet/korina.c
> > > index bf48f0ded9c7d..9d84191de6824 100644
> > > --- a/drivers/net/ethernet/korina.c
> > > +++ b/drivers/net/ethernet/korina.c
> > > @@ -216,7 +216,6 @@ static int korina_send_packet(struct sk_buff *skb,
> > > struct net_device *dev)
> > > netif_stop_queue(dev);
> > > else {
> > > dev->stats.tx_dropped++;
> > > - dev_kfree_skb_any(skb);
> > > spin_unlock_irqrestore(&lp->lock, flags);
> > >
> > > return NETDEV_TX_BUSY;
> > >
> >
> > As this skb is returned to the stack (and not dropped), the tx_dropped
> > statistics increment looks bogus too.
>
> Since this is clearly an ugly use after free, and nobody complained we
> can assume that the driver correctly stops its TX queue ahead of time.
> So perhaps we can change the return value to NETDEV_TX_OK instead.
Hi Jakub,
Thanks for the review.
Ok, if this is the preferred fix I will respin the patch this way.
Best regards,
Vincent.
