diff options
| author | Johannes Berg <johannes.berg@intel.com> | 2012-11-07 14:02:30 +0100 |
|---|---|---|
| committer | Johannes Berg <johannes.berg@intel.com> | 2012-11-07 18:01:54 +0100 |
| commit | 1c963bec3534b175eed6f216a9d6ed6f082fe740 (patch) | |
| tree | f70e477a8cfcf6c7b9010f8ebaf2290182320018 /net | |
| parent | 4afebd6364903d9616073b1fb71a75291e55dfec (diff) | |
| download | linux-stable-1c963bec3534b175eed6f216a9d6ed6f082fe740.tar.gz linux-stable-1c963bec3534b175eed6f216a9d6ed6f082fe740.tar.bz2 linux-stable-1c963bec3534b175eed6f216a9d6ed6f082fe740.zip | |
mac80211: fix TX error path
One error path in ieee80211_subif_start_xmit() will
double-free the SKB. Set it to NULL to prevent that.
This issue was introduced by my channel context
changes.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Diffstat (limited to 'net')
| -rw-r--r-- | net/mac80211/tx.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c index 065f81cb5618..b5468876287e 100644 --- a/net/mac80211/tx.c +++ b/net/mac80211/tx.c @@ -2089,6 +2089,7 @@ netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb, head_need = max_t(int, 0, head_need); if (ieee80211_skb_resize(sdata, skb, head_need, true)) { ieee80211_free_txskb(&local->hw, skb); + skb = NULL; goto fail_rcu; } } |