summaryrefslogtreecommitdiffstats
path: root/drivers/net/wireless/mac80211_hwsim.c
diff options
context:
space:
mode:
authorThomas Huehn <thomas@net.t-labs.tu-berlin.de>2012-07-13 20:52:24 +0200
committerJohannes Berg <johannes.berg@intel.com>2012-07-17 11:42:08 +0200
commitb0e40e72be42153cd6473ca1fa69058a30adb2bb (patch)
tree06ea78263fd7330630bc7db6848b1f812363862f /drivers/net/wireless/mac80211_hwsim.c
parentmac80211: fix tx-mgmt cookie value being left uninitialized (diff)
downloadlinux-b0e40e72be42153cd6473ca1fa69058a30adb2bb.tar.xz
linux-b0e40e72be42153cd6473ca1fa69058a30adb2bb.zip
mac80211_hwsim: fix race condition with sta/vif pointers
info->control.sta and control.vif may only be dereferenced during the drv_tx call otherwise could lead to use-after-free bugs. Signed-off-by: Thomas Huehn <thomas@net.t-labs.tu-berlin.de> [reword commit message] Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Diffstat (limited to 'drivers/net/wireless/mac80211_hwsim.c')
-rw-r--r--drivers/net/wireless/mac80211_hwsim.c5
1 files changed, 0 insertions, 5 deletions
diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
index 3f38d846b093..826ac7bec73f 100644
--- a/drivers/net/wireless/mac80211_hwsim.c
+++ b/drivers/net/wireless/mac80211_hwsim.c
@@ -1540,11 +1540,6 @@ static int hwsim_tx_info_frame_received_nl(struct sk_buff *skb_2,
/* now send back TX status */
txi = IEEE80211_SKB_CB(skb);
- if (txi->control.vif)
- hwsim_check_magic(txi->control.vif);
- if (txi->control.sta)
- hwsim_check_sta_magic(txi->control.sta);
-
ieee80211_tx_info_clear_status(txi);
for (i = 0; i < IEEE80211_TX_MAX_RATES; i++) {