diff options
| author | Felix Fietkau <nbd@openwrt.org> | 2012-05-24 14:32:20 +0200 |
|---|---|---|
| committer | Ben Hutchings <ben@decadent.org.uk> | 2012-06-10 14:41:43 +0100 |
| commit | 2bb9966c233293c9959f4d77a3c994182604472e (patch) | |
| tree | 6212a93f31fce6d315983ce951fd22ad0909c8fe /kernel/fork.c | |
| parent | c293fd77c4775f517926a61605c35b5bd2bd71cf (diff) | |
ath9k: fix a use-after-free-bug when ath_tx_setup_buffer() fails
commit 81357a281dcc454841532c46b30e6f2ba12b73ea upstream.
ath_tx_setup_buffer() can fail if there is no ath_buf left, or if mapping DMA
failed. In this case it frees the skb passed to it.
If ath_tx_setup_buffer is called from ath_tx_form_aggr, the skb is still
linked into the tid buffer list and must be dequeued before being released.
Signed-off-by: Felix Fietkau <nbd@openwrt.org>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Diffstat (limited to 'kernel/fork.c')
0 files changed, 0 insertions, 0 deletions