From: Richard Cochran <richardcochran@gmail.com>
Date: Sun, 19 Jun 2011 21:48:06 +0000 (+0000)
Subject: pxa168_eth: fix race in transmit path.
X-Git-Tag: v2.6.39.3~63
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=13437076f02872e9cd3273959c9ff8b2693f243a;p=thirdparty%2Fkernel%2Fstable.git

pxa168_eth: fix race in transmit path.

commit 384420409d9b5d4443940abace49363d26135412 upstream.

Because the socket buffer is freed in the completion interrupt, it is not
safe to access it after submitting it to the hardware.

Acked-by: Sachin Sanap <ssanap@marvell.com>
Cc: Zhangfei Gao <zgao6@marvell.com>
Cc: Philip Rakity <prakity@marvell.com>
Signed-off-by: Richard Cochran <richard.cochran@omicron.at>
Acked-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---

diff --git a/drivers/net/pxa168_eth.c b/drivers/net/pxa168_eth.c
index 89f7540d90f90..5f597ca592bb8 100644
--- a/drivers/net/pxa168_eth.c
+++ b/drivers/net/pxa168_eth.c
@@ -1273,7 +1273,7 @@ static int pxa168_eth_start_xmit(struct sk_buff *skb, struct net_device *dev)
 	wmb();
 	wrl(pep, SDMA_CMD, SDMA_CMD_TXDH | SDMA_CMD_ERD);
 
-	stats->tx_bytes += skb->len;
+	stats->tx_bytes += length;
 	stats->tx_packets++;
 	dev->trans_start = jiffies;
 	if (pep->tx_ring_size - pep->tx_desc_count <= 1) {