git.openpandora.org / pandora-kernel.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: ceea2a5) | patch
ath9k: fix a use-after-free-bug when ath_tx_setup_buffer() fails
authorFelix Fietkau <nbd@openwrt.org>
Thu, 24 May 2012 12:32:20 +0000 (14:32 +0200)
committerJohn W. Linville <linville@tuxdriver.com>
Tue, 29 May 2012 17:45:22 +0000 (13:45 -0400)
commit81357a281dcc454841532c46b30e6f2ba12b73ea
treea5e0bcf8b7b79434e8242695c2d6f8b24e4dda7dtree | snapshot
parentceea2a51969f8b578777c99ec2718021427770c3commit | diff
ath9k: fix a use-after-free-bug when ath_tx_setup_buffer() fails

ath_tx_setup_buffer() can fail if there is no ath_buf left, or if mapping DMA
failed. In this case it frees the skb passed to it.
If ath_tx_setup_buffer is called from ath_tx_form_aggr, the skb is still
linked into the tid buffer list and must be dequeued before being released.

Signed-off-by: Felix Fietkau <nbd@openwrt.org>
Cc: stable@vger.kernel.org
Signed-off-by: John W. Linville <linville@tuxdriver.com>
drivers/net/wireless/ath/ath9k/xmit.c diff | blob | history
Pandora Kernel Repository