ATM: solos-pci, remove use after free

Stanse found we do in console_show:
kfree_skb(skb);
return skb->len;
which is not good. Fix that by remembering the len and use it in the
function instead.

Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Cc: Chas Williams <chas@cmf.nrl.navy.mil>
Acked-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

authored by Jiri Slaby and committed by David S. Miller f1ee89d5 03c698c9

+5 -3
+5 -3
drivers/atm/solos-pci.c
··· 444 struct atm_dev *atmdev = container_of(dev, struct atm_dev, class_dev); 445 struct solos_card *card = atmdev->dev_data; 446 struct sk_buff *skb; 447 448 spin_lock(&card->cli_queue_lock); 449 skb = skb_dequeue(&card->cli_queue[SOLOS_CHAN(atmdev)]); ··· 452 if(skb == NULL) 453 return sprintf(buf, "No data.\n"); 454 455 - memcpy(buf, skb->data, skb->len); 456 - dev_dbg(&card->dev->dev, "len: %d\n", skb->len); 457 458 kfree_skb(skb); 459 - return skb->len; 460 } 461 462 static int send_command(struct solos_card *card, int dev, const char *buf, size_t size)
··· 444 struct atm_dev *atmdev = container_of(dev, struct atm_dev, class_dev); 445 struct solos_card *card = atmdev->dev_data; 446 struct sk_buff *skb; 447 + unsigned int len; 448 449 spin_lock(&card->cli_queue_lock); 450 skb = skb_dequeue(&card->cli_queue[SOLOS_CHAN(atmdev)]); ··· 451 if(skb == NULL) 452 return sprintf(buf, "No data.\n"); 453 454 + len = skb->len; 455 + memcpy(buf, skb->data, len); 456 + dev_dbg(&card->dev->dev, "len: %d\n", len); 457 458 kfree_skb(skb); 459 + return len; 460 } 461 462 static int send_command(struct solos_card *card, int dev, const char *buf, size_t size)