diff options
| author | Eugene Teo <eugeneteo@kernel.sg> | 2007-05-21 22:30:22 +0800 |
|---|---|---|
| committer | John W. Linville <linville@tuxdriver.com> | 2007-05-22 11:02:29 -0400 |
| commit | 412e8a0ebf1a58c060cc76438e5b6d33789c5e20 (patch) | |
| tree | c91d0ff90683badafde8662564274d009e57fe79 /drivers/net/wireless/libertas/rx.c | |
| parent | 596f2d0554352f1089f7478b309b27d8cdf5cd4f (diff) | |
[PATCH] drivers/net/wireless/libertas/rx.c: fix use-after-free
skb could have been freed by then. Also, in libertas_upload_rx_packet(),
skb->protocol is initialized by eth_type_trans().
Signed-off-by: Eugene Teo <eugeneteo@kernel.sg>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Diffstat (limited to 'drivers/net/wireless/libertas/rx.c')
| -rw-r--r-- | drivers/net/wireless/libertas/rx.c | 2 |
1 files changed, 0 insertions, 2 deletions
diff --git a/drivers/net/wireless/libertas/rx.c b/drivers/net/wireless/libertas/rx.c index b19b5aa8713b..96619a32951b 100644 --- a/drivers/net/wireless/libertas/rx.c +++ b/drivers/net/wireless/libertas/rx.c @@ -441,7 +441,5 @@ static int process_rxed_802_11_packet(wlan_private * priv, struct sk_buff *skb) done: LEAVE(); - skb->protocol = __constant_htons(0x0019); /* ETH_P_80211_RAW */ - return (ret); } |