xen-netfront: Avoid deref'ing skbafter it is potentially freed.

xennet_tx_bug_gc can free the skb before we use it, so make sure we don't.

Signed-off-by: Keir Fraser <[email protected]>
Signed-off-by: Jeremy Fitzhardinge <[email protected]>
Cc: Jeff Garzik <[email protected]>
Signed-off-by: Jeff Garzik <[email protected]>

diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c
index 489f69c5d6ca057f671c8d78faa42c1683814e62..4445810335a8ef7dff90f4c01683308d12e66c73 100644 (file)
--- a/drivers/net/xen-netfront.c
+++ b/drivers/net/xen-netfront.c
@@ -566,6 +566,10 @@ static int xennet_start_xmit(struct sk_buff *skb, struct net_device *dev)
        if (notify)
                notify_remote_via_irq(np->netdev->irq);
 
+       np->stats.tx_bytes += skb->len;
+       np->stats.tx_packets++;
+
+       /* Note: It is not safe to access skb after xennet_tx_buf_gc()! */
        xennet_tx_buf_gc(dev);
 
        if (!netfront_tx_slot_available(np))
@@ -573,9 +577,6 @@ static int xennet_start_xmit(struct sk_buff *skb, struct net_device *dev)
 
        spin_unlock_irq(&np->tx_lock);
 
-       np->stats.tx_bytes += skb->len;
-       np->stats.tx_packets++;
-
        return 0;
 
  drop: