diff options
| author | Johannes Berg <johannes.berg@intel.com> | 2010-09-24 11:20:47 +0200 |
|---|---|---|
| committer | John W. Linville <linville@tuxdriver.com> | 2010-09-24 15:21:55 -0400 |
| commit | cd87a2d3a33d75a646f1aa1aa2ee5bf712d6f963 (patch) | |
| tree | 45709536e1c4f36c345b16f90849c7833d23337b /net/wireless/core.c | |
| parent | df6d02300f7c2fbd0fbe626d819c8e5237d72c62 (diff) | |
| download | linux-cd87a2d3a33d75a646f1aa1aa2ee5bf712d6f963.tar.bz2 | |
mac80211: fix use-after-free
commit 8c0c709eea5cbab97fb464cd68b06f24acc58ee1
Author: Johannes Berg <johannes@sipsolutions.net>
Date: Wed Nov 25 17:46:15 2009 +0100
mac80211: move cmntr flag out of rx flags
moved the CMTR flag into the skb's status, and
in doing so introduced a use-after-free -- when
the skb has been handed to cooked monitors the
status setting will touch now invalid memory.
Additionally, moving it there has effectively
discarded the optimisation -- since the bit is
only ever set on freed SKBs, and those were a
copy, it could never be checked.
For the current release, fixing this properly
is a bit too involved, so let's just remove the
problematic code and leave userspace with one
copy of each frame for each virtual interface.
Cc: stable@kernel.org [2.6.33+]
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Diffstat (limited to 'net/wireless/core.c')
0 files changed, 0 insertions, 0 deletions