diff options
| author | John W. Linville <linville@tuxdriver.com> | 2010-09-24 15:52:49 -0400 |
|---|---|---|
| committer | John W. Linville <linville@tuxdriver.com> | 2010-09-27 15:57:48 -0400 |
| commit | 7c1e183186377e84e6f4e457be0514887f2df4ef (patch) | |
| tree | dbc559ec2dab072eaf57ab7dabe24d95f952c256 | |
| parent | 92e44948b2b3b2db8f39f17033f98ae2356156a5 (diff) | |
| download | op-kernel-dev-7c1e183186377e84e6f4e457be0514887f2df4ef.zip op-kernel-dev-7c1e183186377e84e6f4e457be0514887f2df4ef.tar.gz | |
Revert "mac80211: fix use-after-free"
This reverts commit cd87a2d3a33d75a646f1aa1aa2ee5bf712d6f963.
Author reports it conflicts with proper fixes, applied hereafter.
Signed-off-by: John W. Linville <linville@tuxdriver.com>
| -rw-r--r-- | net/mac80211/rx.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c index 50c0803..29a582d 100644 --- a/net/mac80211/rx.c +++ b/net/mac80211/rx.c @@ -2286,6 +2286,9 @@ static void ieee80211_rx_cooked_monitor(struct ieee80211_rx_data *rx, struct net_device *prev_dev = NULL; struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb); + if (status->flag & RX_FLAG_INTERNAL_CMTR) + goto out_free_skb; + if (skb_headroom(skb) < sizeof(*rthdr) && pskb_expand_head(skb, sizeof(*rthdr), 0, GFP_ATOMIC)) goto out_free_skb; @@ -2344,6 +2347,7 @@ static void ieee80211_rx_cooked_monitor(struct ieee80211_rx_data *rx, } else goto out_free_skb; + status->flag |= RX_FLAG_INTERNAL_CMTR; return; out_free_skb: |
