diff options
| author | John W. Linville <linville@tuxdriver.com> | 2010-09-24 21:52:49 +0200 |
|---|---|---|
| committer | John W. Linville <linville@tuxdriver.com> | 2010-09-27 21:57:48 +0200 |
| commit | 7c1e183186377e84e6f4e457be0514887f2df4ef (patch) | |
| tree | dbc559ec2dab072eaf57ab7dabe24d95f952c256 /net/mac80211 | |
| parent | nl80211: Fix exit from nl80211_set_power_save (diff) | |
| download | linux-7c1e183186377e84e6f4e457be0514887f2df4ef.tar.xz linux-7c1e183186377e84e6f4e457be0514887f2df4ef.zip | |
Revert "mac80211: fix use-after-free"
This reverts commit cd87a2d3a33d75a646f1aa1aa2ee5bf712d6f963.
Author reports it conflicts with proper fixes, applied hereafter.
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Diffstat (limited to 'net/mac80211')
| -rw-r--r-- | net/mac80211/rx.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c index 50c0803a63ba..29a582df6371 100644 --- a/net/mac80211/rx.c +++ b/net/mac80211/rx.c @@ -2286,6 +2286,9 @@ static void ieee80211_rx_cooked_monitor(struct ieee80211_rx_data *rx, struct net_device *prev_dev = NULL; struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb); + if (status->flag & RX_FLAG_INTERNAL_CMTR) + goto out_free_skb; + if (skb_headroom(skb) < sizeof(*rthdr) && pskb_expand_head(skb, sizeof(*rthdr), 0, GFP_ATOMIC)) goto out_free_skb; @@ -2344,6 +2347,7 @@ static void ieee80211_rx_cooked_monitor(struct ieee80211_rx_data *rx, } else goto out_free_skb; + status->flag |= RX_FLAG_INTERNAL_CMTR; return; out_free_skb: |