| commit | 81357a281dcc454841532c46b30e6f2ba12b73ea | [log] [tgz] |
|---|---|---|
| author | Felix Fietkau <nbd@openwrt.org> | Thu May 24 14:32:20 2012 +0200 |
| committer | John W. Linville <linville@tuxdriver.com> | Tue May 29 13:45:22 2012 -0400 |
| tree | a5e0bcf8b7b79434e8242695c2d6f8b24e4dda7d | |
| parent | ceea2a51969f8b578777c99ec2718021427770c3 [diff] |
ath9k: fix a use-after-free-bug when ath_tx_setup_buffer() fails ath_tx_setup_buffer() can fail if there is no ath_buf left, or if mapping DMA failed. In this case it frees the skb passed to it. If ath_tx_setup_buffer is called from ath_tx_form_aggr, the skb is still linked into the tid buffer list and must be dequeued before being released. Signed-off-by: Felix Fietkau <nbd@openwrt.org> Cc: stable@vger.kernel.org Signed-off-by: John W. Linville <linville@tuxdriver.com>