commit 7c1e183186377e84e6f4e457be0514887f2df4ef
author John W. Linville <linville@tuxdriver.com> Fri Sep 24 15:52:49 2010 -0400
committer John W. Linville <linville@tuxdriver.com> Mon Sep 27 15:57:48 2010 -0400
tree dbc559ec2dab072eaf57ab7dabe24d95f952c256
parent 92e44948b2b3b2db8f39f17033f98ae2356156a5

Revert "mac80211: fix use-after-free"

This reverts commit cd87a2d3a33d75a646f1aa1aa2ee5bf712d6f963.

Author reports it conflicts with proper fixes, applied hereafter.

Signed-off-by: John W. Linville <linville@tuxdriver.com>

net/mac80211/rx.c

diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 50c0803..29a582d 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -2286,6 +2286,9 @@
 	struct net_device *prev_dev = NULL;
 	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
 
+	if (status->flag & RX_FLAG_INTERNAL_CMTR)
+		goto out_free_skb;
+
 	if (skb_headroom(skb) < sizeof(*rthdr) &&
 	    pskb_expand_head(skb, sizeof(*rthdr), 0, GFP_ATOMIC))
 		goto out_free_skb;
@@ -2344,6 +2347,7 @@
 	} else
 		goto out_free_skb;
 
+	status->flag |= RX_FLAG_INTERNAL_CMTR;
 	return;
 
  out_free_skb: