Revert "mac80211: fix use-after-free"
authorJohn W. Linville <linville@tuxdriver.com>
Fri, 24 Sep 2010 19:52:49 +0000 (15:52 -0400)
committerJohn W. Linville <linville@tuxdriver.com>
Mon, 27 Sep 2010 19:57:48 +0000 (15:57 -0400)
This reverts commit cd87a2d3a33d75a646f1aa1aa2ee5bf712d6f963.

Author reports it conflicts with proper fixes, applied hereafter.

Signed-off-by: John W. Linville <linville@tuxdriver.com>
net/mac80211/rx.c

index 50c0803a63baabbe9fd4a014cfd2bc14846ae437..29a582df63718b6519dbe4856aa07d1bb44c35cb 100644 (file)
@@ -2286,6 +2286,9 @@ static void ieee80211_rx_cooked_monitor(struct ieee80211_rx_data *rx,
        struct net_device *prev_dev = NULL;
        struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
 
+       if (status->flag & RX_FLAG_INTERNAL_CMTR)
+               goto out_free_skb;
+
        if (skb_headroom(skb) < sizeof(*rthdr) &&
            pskb_expand_head(skb, sizeof(*rthdr), 0, GFP_ATOMIC))
                goto out_free_skb;
@@ -2344,6 +2347,7 @@ static void ieee80211_rx_cooked_monitor(struct ieee80211_rx_data *rx,
        } else
                goto out_free_skb;
 
+       status->flag |= RX_FLAG_INTERNAL_CMTR;
        return;
 
  out_free_skb: