hyperv: Fix a bug in netvsc_start_xmit()

After the packet is successfully sent, we should not touch the skb
as it may have been freed. This patch is based on the work done by
Long Li <[email protected]>.

In this version of the patch I have fixed issues pointed out by David.
David, please queue this up for stable.

Signed-off-by: K. Y. Srinivasan <[email protected]>
Tested-by: Long Li <[email protected]>
Tested-by: Sitsofe Wheeler <[email protected]>
Signed-off-by: David S. Miller <[email protected]>

diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c
index a9c5eaadc426b8cd93e1cacfb65142d306b22f78..0fcb5e7eb073e9eb66b2c17e53675ef87490639a 100644 (file)
--- a/drivers/net/hyperv/netvsc_drv.c
+++ b/drivers/net/hyperv/netvsc_drv.c
@@ -387,6 +387,7 @@ static int netvsc_start_xmit(struct sk_buff *skb, struct net_device *net)
        int  hdr_offset;
        u32 net_trans_info;
        u32 hash;
+       u32 skb_length = skb->len;
 
 
        /* We will atmost need two pages to describe the rndis
@@ -562,7 +563,7 @@ do_send:
 
 drop:
        if (ret == 0) {
-               net->stats.tx_bytes += skb->len;
+               net->stats.tx_bytes += skb_length;
                net->stats.tx_packets++;
        } else {
                kfree(packet);