RE: [RFC v3 2/2] iwlwifi: mvm: send large SKBs to the transport

2015-10-22 Thread Grumbach, Emmanuel
> > On Wed, 2015-10-21 at 21:34 +0300, Emmanuel Grumbach wrote: > > + > > + if (skb->protocol == htons(ETH_P_IP)) { > > + ip_hdr(tmp)->id = ip_hdr(skb)->id; > > Too late, you already called consume_skb(skb). > So this is a potential use after free. Ouch - thanks for

Re: [RFC v3 2/2] iwlwifi: mvm: send large SKBs to the transport

2015-10-22 Thread Eric Dumazet
On Wed, 2015-10-21 at 21:34 +0300, Emmanuel Grumbach wrote: > + > + if (skb->protocol == htons(ETH_P_IP)) { > + ip_hdr(tmp)->id = ip_hdr(skb)->id; Too late, you already called consume_skb(skb). So this is a potential use after free. > +