commit 5185c7c20a4b88892f868ad8d92d1b640b1edba9
author Eric Sesterhenn <snakebyte@gmx.de> Wed Mar 22 22:30:34 2006 +0100
committer Jeff Garzik <jeff@garzik.org> Wed Mar 22 20:30:45 2006 -0500
tree 53674f28e6dd666a59f5495f73149736ec260505
parent 494aced2cda34c186083f7d53c419426eea3d584

[PATCH] Use after free in net/tulip/de2104x.c

hi,

this fixes coverity bug #912, where skb is freed first,
and dereferenced a few lines later with skb->len.

Signed-off-by: Eric Sesterhenn <snakebyte@gmx.de>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

drivers/net/tulip/de2104x.c

diff --git a/drivers/net/tulip/de2104x.c b/drivers/net/tulip/de2104x.c
index 6299e18..e3dd144 100644
--- a/drivers/net/tulip/de2104x.c
+++ b/drivers/net/tulip/de2104x.c
@@ -1327,11 +1327,11 @@
 		struct sk_buff *skb = de->tx_skb[i].skb;
 		if ((skb) && (skb != DE_DUMMY_SKB)) {
 			if (skb != DE_SETUP_SKB) {
-				dev_kfree_skb(skb);
 				de->net_stats.tx_dropped++;
 				pci_unmap_single(de->pdev,
 					de->tx_skb[i].mapping,
 					skb->len, PCI_DMA_TODEVICE);
+				dev_kfree_skb(skb);
 			} else {
 				pci_unmap_single(de->pdev,
 					de->tx_skb[i].mapping,