summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorJohn W. Linville <linville@tuxdriver.com>2010-09-24 15:52:49 -0400
committerJohn W. Linville <linville@tuxdriver.com>2010-09-27 15:57:48 -0400
commit7c1e183186377e84e6f4e457be0514887f2df4ef (patch)
treedbc559ec2dab072eaf57ab7dabe24d95f952c256
parent92e44948b2b3b2db8f39f17033f98ae2356156a5 (diff)
downloadop-kernel-dev-7c1e183186377e84e6f4e457be0514887f2df4ef.zip
op-kernel-dev-7c1e183186377e84e6f4e457be0514887f2df4ef.tar.gz
Revert "mac80211: fix use-after-free"
This reverts commit cd87a2d3a33d75a646f1aa1aa2ee5bf712d6f963. Author reports it conflicts with proper fixes, applied hereafter. Signed-off-by: John W. Linville <linville@tuxdriver.com>
-rw-r--r--net/mac80211/rx.c4
1 files changed, 4 insertions, 0 deletions
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 50c0803..29a582d 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -2286,6 +2286,9 @@ static void ieee80211_rx_cooked_monitor(struct ieee80211_rx_data *rx,
struct net_device *prev_dev = NULL;
struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
+ if (status->flag & RX_FLAG_INTERNAL_CMTR)
+ goto out_free_skb;
+
if (skb_headroom(skb) < sizeof(*rthdr) &&
pskb_expand_head(skb, sizeof(*rthdr), 0, GFP_ATOMIC))
goto out_free_skb;
@@ -2344,6 +2347,7 @@ static void ieee80211_rx_cooked_monitor(struct ieee80211_rx_data *rx,
} else
goto out_free_skb;
+ status->flag |= RX_FLAG_INTERNAL_CMTR;
return;
out_free_skb:
OpenPOWER on IntegriCloud