ath9k: Fix potential use-after-free.
authorBen Greear <greearb@candelatech.com>
Wed, 13 Oct 2010 19:01:23 +0000 (12:01 -0700)
committerJohn W. Linville <linville@tuxdriver.com>
Wed, 13 Oct 2010 19:45:23 +0000 (15:45 -0400)
The ath_debug_stat_tx references bf->bf_mpdu, which
is the skb consumed by  ath_tx_complete.  So, call
the ath_debug_stat_tx method first.

Signed-off-by: Ben Greear <greearb@candelatech.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
drivers/net/wireless/ath/ath9k/xmit.c

index 9a11099dd86a3db1f081d6ded402fdb72883c787..9b17108adc7cc31d2818d3b4e683250567f685f8 100644 (file)
@@ -1924,8 +1924,8 @@ static void ath_tx_complete_buf(struct ath_softc *sc, struct ath_buf *bf,
                else
                        complete(&sc->paprd_complete);
        } else {
-               ath_tx_complete(sc, skb, bf->aphy, tx_flags);
                ath_debug_stat_tx(sc, txq, bf, ts);
+               ath_tx_complete(sc, skb, bf->aphy, tx_flags);
        }
 
        /*