diff options
| author | Felix Fietkau <nbd@openwrt.org> | 2012-05-24 14:32:20 +0200 |
|---|---|---|
| committer | John W. Linville <linville@tuxdriver.com> | 2012-05-29 13:45:22 -0400 |
| commit | 81357a281dcc454841532c46b30e6f2ba12b73ea (patch) | |
| tree | a5e0bcf8b7b79434e8242695c2d6f8b24e4dda7d /drivers/net/wireless/ath/ath9k/ar9330_1p1_initvals.h | |
| parent | ceea2a51969f8b578777c99ec2718021427770c3 (diff) | |
ath9k: fix a use-after-free-bug when ath_tx_setup_buffer() fails
ath_tx_setup_buffer() can fail if there is no ath_buf left, or if mapping DMA
failed. In this case it frees the skb passed to it.
If ath_tx_setup_buffer is called from ath_tx_form_aggr, the skb is still
linked into the tid buffer list and must be dequeued before being released.
Signed-off-by: Felix Fietkau <nbd@openwrt.org>
Cc: stable@vger.kernel.org
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Diffstat (limited to 'drivers/net/wireless/ath/ath9k/ar9330_1p1_initvals.h')
0 files changed, 0 insertions, 0 deletions