sfc: fix race in efx_enqueue_skb_tso()

As soon as skb is pushed to hardware, it can be completed and freed, so
we should not dereference skb anymore.

Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/drivers/net/ethernet/sfc/tx.c b/drivers/net/ethernet/sfc/tx.c
index ab4c63570023be908aa1dd016bb9941258f56e83..e0e00b3d6a827a556bc147a2dcffb6b266197143 100644 (file)
--- a/drivers/net/ethernet/sfc/tx.c
+++ b/drivers/net/ethernet/sfc/tx.c
@@ -1173,11 +1173,11 @@ static int efx_enqueue_skb_tso(struct efx_tx_queue *tx_queue,
                        goto mem_err;
        }
 
+       netdev_tx_sent_queue(tx_queue->core_txq, skb->len);
+
        /* Pass off to hardware */
        efx_nic_push_buffers(tx_queue);
 
-       netdev_tx_sent_queue(tx_queue->core_txq, skb->len);
-
        tx_queue->tso_bursts++;
        return NETDEV_TX_OK;