Patchwork [3.5.y.z,extended,stable] Patch "solos-pci: fix double-free of TX skb in DMA mode" has been added to staging queue

mail settings
Submitter Herton Ronaldo Krzesinski
Date Jan. 7, 2013, 8:38 p.m.
Message ID <>
Download mbox | patch
Permalink /patch/210216/
State New
Headers show


Herton Ronaldo Krzesinski - Jan. 7, 2013, 8:38 p.m.
This is a note to let you know that I have just added a patch titled

    solos-pci: fix double-free of TX skb in DMA mode

to the linux-3.5.y-queue branch of the 3.5.y.z extended stable tree 
which can be found at:;a=shortlog;h=refs/heads/linux-3.5.y-queue

If you, or anyone else, feels it should not be added to this tree, please 
reply to this email.

For more information about the 3.5.y.z tree, see



From 2c1e3d47c60a2bb052c9988bc1896b7a1bdc4866 Mon Sep 17 00:00:00 2001
From: David Woodhouse <>
Date: Tue, 11 Dec 2012 14:57:14 +0000
Subject: [PATCH] solos-pci: fix double-free of TX skb in DMA mode

commit cae49ede00ec3d0cda290b03fee55b72b49efc11 upstream.

We weren't clearing card->tx_skb[port] when processing the TX done interrupt.
If there wasn't another skb ready to transmit immediately, this led to a
double-free because we'd free it *again* next time we did have a packet to

Signed-off-by: David Woodhouse <>
Signed-off-by: David S. Miller <>
Signed-off-by: Herton Ronaldo Krzesinski <>
 drivers/atm/solos-pci.c |    5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)



diff --git a/drivers/atm/solos-pci.c b/drivers/atm/solos-pci.c
index 9851093..1853a45 100644
--- a/drivers/atm/solos-pci.c
+++ b/drivers/atm/solos-pci.c
@@ -967,10 +967,11 @@  static uint32_t fpga_tx(struct solos_card *card)
 	for (port = 0; tx_pending; tx_pending >>= 1, port++) {
 		if (tx_pending & 1) {
 			struct sk_buff *oldskb = card->tx_skb[port];
-			if (oldskb)
+			if (oldskb) {
 				pci_unmap_single(card->dev, SKB_CB(oldskb)->dma_addr,
 						 oldskb->len, PCI_DMA_TODEVICE);
+				card->tx_skb[port] = NULL;
+			}
 			skb = skb_dequeue(&card->tx_queue[port]);
 			if (!skb)