gfar_clean_rx_ring() keeps a frame that spans several Rx buffers in rx_queue->skb between NAPI polls. When the interface is stopped (close, MTU change, reset), free_skb_rx_queue() frees that skb but leaves the pointer set, and nothing clears it when the rings are set up again. After the restart, gfar_clean_rx_ring() picks up the stale pointer. The first buffer it sees has RXBD_FIRST set, so the overrun handling frees the skb a second time. By then the skb has usually been reallocated, so the second free releases another owner's skb and data while they are still in use. Clear rx_queue->skb after freeing it. Fixes: 75354148ce69 ("gianfar: Add paged allocation and Rx S/G") Cc: stable@vger.kernel.org Signed-off-by: Anthony Pighin --- drivers/net/ethernet/freescale/gianfar.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/net/ethernet/freescale/gianfar.c b/drivers/net/ethernet/freescale/gianfar.c index cf636fc5aafa..19010e08fc55 100644 --- a/drivers/net/ethernet/freescale/gianfar.c +++ b/drivers/net/ethernet/freescale/gianfar.c @@ -1092,6 +1092,7 @@ static void free_skb_rx_queue(struct gfar_priv_rx_q *rx_queue) struct rxbd8 *rxbdp = rx_queue->rx_bd_base; dev_kfree_skb(rx_queue->skb); + rx_queue->skb = NULL; for (i = 0; i < rx_queue->rx_ring_size; i++) { struct gfar_rx_buff *rxb = &rx_queue->rx_buff[i]; -- 2.43.0