From: Ben Greear <greearb@candelatech.com>
Date: Wed, 13 Oct 2010 19:01:23 +0000 (-0700)
Subject: ath9k: Fix potential use-after-free.
X-Git-Url: https://git.stricted.de/?a=commitdiff_plain;h=c23cc81a5e5c1d4486b662cedd0afcdf9145f154;p=GitHub%2Fmoto-9609%2Fandroid_kernel_motorola_exynos9610.git

ath9k: Fix potential use-after-free.

The ath_debug_stat_tx references bf->bf_mpdu, which
is the skb consumed by 	ath_tx_complete.  So, call
the ath_debug_stat_tx method first.

Signed-off-by: Ben Greear <greearb@candelatech.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
---

diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
index 9a11099dd86a..9b17108adc7c 100644
--- a/drivers/net/wireless/ath/ath9k/xmit.c
+++ b/drivers/net/wireless/ath/ath9k/xmit.c
@@ -1924,8 +1924,8 @@ static void ath_tx_complete_buf(struct ath_softc *sc, struct ath_buf *bf,
 		else
 			complete(&sc->paprd_complete);
 	} else {
-		ath_tx_complete(sc, skb, bf->aphy, tx_flags);
 		ath_debug_stat_tx(sc, txq, bf, ts);
+		ath_tx_complete(sc, skb, bf->aphy, tx_flags);
 	}
 
 	/*