diff options
| author | Ben Greear <greearb@candelatech.com> | 2010-10-13 21:01:23 +0200 |
|---|---|---|
| committer | John W. Linville <linville@tuxdriver.com> | 2010-10-13 21:45:23 +0200 |
| commit | c23cc81a5e5c1d4486b662cedd0afcdf9145f154 (patch) | |
| tree | 9b7a1a2b030d5298d1d4967f354bb09ec4e90232 | |
| parent | mac80211: fix SMPS request (diff) | |
| download | linux-c23cc81a5e5c1d4486b662cedd0afcdf9145f154.tar.xz linux-c23cc81a5e5c1d4486b662cedd0afcdf9145f154.zip | |
ath9k: Fix potential use-after-free.
The ath_debug_stat_tx references bf->bf_mpdu, which
is the skb consumed by ath_tx_complete. So, call
the ath_debug_stat_tx method first.
Signed-off-by: Ben Greear <greearb@candelatech.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
| -rw-r--r-- | drivers/net/wireless/ath/ath9k/xmit.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c index 9a11099dd86a..9b17108adc7c 100644 --- a/drivers/net/wireless/ath/ath9k/xmit.c +++ b/drivers/net/wireless/ath/ath9k/xmit.c @@ -1924,8 +1924,8 @@ static void ath_tx_complete_buf(struct ath_softc *sc, struct ath_buf *bf, else complete(&sc->paprd_complete); } else { - ath_tx_complete(sc, skb, bf->aphy, tx_flags); ath_debug_stat_tx(sc, txq, bf, ts); + ath_tx_complete(sc, skb, bf->aphy, tx_flags); } /* |