Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 853da11b authored by Pavel Roskin's avatar Pavel Roskin Committed by John W. Linville
Browse files

ath9k: fix access to a freed skb in ath_rx_tasklet() 



Signed-off-by: default avatarPavel Roskin <proski@gnu.org>
Signed-off-by: default avatarJohn W. Linville <linville@tuxdriver.com>
parent c6dbe17f

drivers/net/wireless/ath9k/recv.c

+3 −1
Original line number Diff line number Diff line
@@ -493,6 +493,7 @@ int ath_rx_tasklet(struct ath_softc *sc, int flush) 
	int hdrlen, padsize, retval;

	bool decrypt_error = false;

	u8 keyix;

	__le16 fc;



	spin_lock_bh(&sc->rx.rxbuflock);
@@ -606,6 +607,7 @@ int ath_rx_tasklet(struct ath_softc *sc, int flush) 
		/* see if any padding is done by the hw and remove it */

		hdr = (struct ieee80211_hdr *)skb->data;

		hdrlen = ieee80211_get_hdrlen_from_skb(skb);

		fc = hdr->frame_control;



		/* The MAC header is padded to have 32-bit boundary if the

		 * packet payload is non-zero. The general calculation for
@@ -690,7 +692,7 @@ int ath_rx_tasklet(struct ath_softc *sc, int flush) 
			sc->rx.rxotherant = 0;

		}



		if (ieee80211_is_beacon(hdr->frame_control) &&

		if (ieee80211_is_beacon(fc) &&

				(sc->sc_flags & SC_OP_WAIT_FOR_BEACON)) {

			sc->sc_flags &= ~SC_OP_WAIT_FOR_BEACON;

			ath9k_hw_setpower(sc->sc_ah, ATH9K_PM_NETWORK_SLEEP);