diff options
| author | Thomas Huehn <thomas@net.t-labs.tu-berlin.de> | 2012-07-17 22:16:13 +0200 |
|---|---|---|
| committer | John W. Linville <linville@tuxdriver.com> | 2012-07-26 15:37:57 -0400 |
| commit | 4581d91b7717152001192112027596fbdeec06f6 (patch) | |
| tree | eca9850ffb94a18ed2b2bf3271823b1b48593eef /drivers | |
| parent | c297977ec18deb36b2c0a5ee57101f7ab736ec00 (diff) | |
| download | linux-4581d91b7717152001192112027596fbdeec06f6.tar.bz2 | |
mac80211_hwsim: fix possible race condition in usage of info->control.sta & control.vif
info->control.sta and control.vif may only be dereferenced during the
drv_tx call otherwise could lead to use-after-free bugs.
Signed-off-by: Thomas Huehn <thomas@net.t-labs.tu-berlin.de>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/net/wireless/mac80211_hwsim.c | 5 |
1 files changed, 0 insertions, 5 deletions
diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c index 643f968b05ee..00838395778c 100644 --- a/drivers/net/wireless/mac80211_hwsim.c +++ b/drivers/net/wireless/mac80211_hwsim.c @@ -739,11 +739,6 @@ static void mac80211_hwsim_tx(struct ieee80211_hw *hw, struct sk_buff *skb) txi = IEEE80211_SKB_CB(skb); - if (txi->control.vif) - hwsim_check_magic(txi->control.vif); - if (txi->control.sta) - hwsim_check_sta_magic(txi->control.sta); - ieee80211_tx_info_clear_status(txi); /* frame was transmitted at most favorable rate at first attempt */ |