projects
/
GitHub
/
MotorolaMobilityLLC
/
kernel-slsi.git
/ commitdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
| commitdiff |
tree
raw
|
patch
| inline |
side by side
(parent:
92e4494
)
Revert "mac80211: fix use-after-free"
author
John W. Linville
<linville@tuxdriver.com>
Fri, 24 Sep 2010 19:52:49 +0000
(15:52 -0400)
committer
John W. Linville
<linville@tuxdriver.com>
Mon, 27 Sep 2010 19:57:48 +0000
(15:57 -0400)
This reverts commit
cd87a2d3a33d75a646f1aa1aa2ee5bf712d6f963
.
Author reports it conflicts with proper fixes, applied hereafter.
Signed-off-by: John W. Linville <linville@tuxdriver.com>
net/mac80211/rx.c
patch
|
blob
|
blame
|
history
diff --git
a/net/mac80211/rx.c
b/net/mac80211/rx.c
index 50c0803a63baabbe9fd4a014cfd2bc14846ae437..29a582df63718b6519dbe4856aa07d1bb44c35cb 100644
(file)
--- a/
net/mac80211/rx.c
+++ b/
net/mac80211/rx.c
@@
-2286,6
+2286,9
@@
static void ieee80211_rx_cooked_monitor(struct ieee80211_rx_data *rx,
struct net_device *prev_dev = NULL;
struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
+ if (status->flag & RX_FLAG_INTERNAL_CMTR)
+ goto out_free_skb;
+
if (skb_headroom(skb) < sizeof(*rthdr) &&
pskb_expand_head(skb, sizeof(*rthdr), 0, GFP_ATOMIC))
goto out_free_skb;
@@
-2344,6
+2347,7
@@
static void ieee80211_rx_cooked_monitor(struct ieee80211_rx_data *rx,
} else
goto out_free_skb;
+ status->flag |= RX_FLAG_INTERNAL_CMTR;
return;
out_free_skb: