diff options
| author | David S. Miller <davem@davemloft.net> | 2020-09-08 20:12:58 -0700 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2020-09-08 20:12:58 -0700 |
| commit | 6fd40d32ef545628225a00c861908a20bfc510a5 (patch) | |
| tree | 6a5d2d9b344f4427241e2196feb1ba5a1e3e979e /net/mac802154 | |
| parent | 2a154988aa4b2b87bef5dc0678df675829448e32 (diff) | |
| parent | 0ff4628f4c6c1ab87eef9f16b25355cadc426d64 (diff) | |
| download | linux-stable-6fd40d32ef545628225a00c861908a20bfc510a5.tar.gz linux-stable-6fd40d32ef545628225a00c861908a20bfc510a5.tar.bz2 linux-stable-6fd40d32ef545628225a00c861908a20bfc510a5.zip | |
Merge tag 'ieee802154-for-davem-2020-09-08' of git://git.kernel.org/pub/scm/linux/kernel/git/sschmidt/wpan
Stefan Schmidt says:
====================
pull-request: ieee802154 for net 2020-09-08
An update from ieee802154 for your *net* tree.
A potential memory leak fix for ca8210 from Liu Jian,
a check on the return for a register read in adf7242
and finally a user after free fix in the softmac tx
function from Eric found by syzkaller.
====================
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/mac802154')
| -rw-r--r-- | net/mac802154/tx.c | 8 |
1 files changed, 5 insertions, 3 deletions
diff --git a/net/mac802154/tx.c b/net/mac802154/tx.c index ab52811523e9..c829e4a75325 100644 --- a/net/mac802154/tx.c +++ b/net/mac802154/tx.c @@ -34,11 +34,11 @@ void ieee802154_xmit_worker(struct work_struct *work) if (res) goto err_tx; - ieee802154_xmit_complete(&local->hw, skb, false); - dev->stats.tx_packets++; dev->stats.tx_bytes += skb->len; + ieee802154_xmit_complete(&local->hw, skb, false); + return; err_tx: @@ -78,6 +78,8 @@ ieee802154_tx(struct ieee802154_local *local, struct sk_buff *skb) /* async is priority, otherwise sync is fallback */ if (local->ops->xmit_async) { + unsigned int len = skb->len; + ret = drv_xmit_async(local, skb); if (ret) { ieee802154_wake_queue(&local->hw); @@ -85,7 +87,7 @@ ieee802154_tx(struct ieee802154_local *local, struct sk_buff *skb) } dev->stats.tx_packets++; - dev->stats.tx_bytes += skb->len; + dev->stats.tx_bytes += len; } else { local->tx_skb = skb; queue_work(local->workqueue, &local->tx_work); |