From: David S. Miller <davem@davemloft.net>
Date: Sat, 11 Mar 2006 02:08:09 +0000 (-0800)
Subject: [PATCH] Wrong return value corrupts free object in e1000 driver
X-Git-Tag: v2.6.16-rc6~5
X-Git-Url: http://git.openpandora.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=9e927fb6186b6913d47d33068160088a084d568e;p=pandora-kernel.git

[PATCH] Wrong return value corrupts free object in e1000 driver

For some reason, E1000's ->hard_start_xmit() routine returns -EFAULT
instead of one of the NETDEV_TX_* error codes.  In fact, it frees up
the SKB before returning this.  This makes the queueing layer think
the packet should be requeued and subsequently we corrupt a freed
object.

Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Jeff Garzik <jeff@garzik.org>
---

Reading git-diff-tree failed