tree 4130286b0162d3eb16d09286f6b254564faf3ec4
parent efec22b4689bbfdbed26367219e981fcc946b9a6
author Felix Fietkau <nbd@openwrt.org> 1351204271 +0200
committer John W. Linville <linville@tuxdriver.com> 1351534701 -0400

ath9k: fix stale pointers potentially causing access to free'd skbs

bf->bf_next is only while buffers are chained as part of an A-MPDU
in the tx queue. When a tid queue is flushed (e.g. on tearing down
an aggregation session), frames can be enqueued again as normal
transmission, without bf_next being cleared. This can lead to the
old pointer being dereferenced again later.

This patch might fix crashes and "Failed to stop TX DMA!" messages.

Signed-off-by: Felix Fietkau <nbd@openwrt.org>
Cc: stable@vger.kernel.org
Signed-off-by: John W. Linville <linville@tuxdriver.com>