summaryrefslogtreecommitdiffstats
path: root/drivers/net
diff options
context:
space:
mode:
authorJohannes Berg <johannes.berg@intel.com>2010-09-24 11:20:47 +0200
committerJohn W. Linville <linville@tuxdriver.com>2010-09-24 15:21:55 -0400
commitcd87a2d3a33d75a646f1aa1aa2ee5bf712d6f963 (patch)
tree45709536e1c4f36c345b16f90849c7833d23337b /drivers/net
parentdf6d02300f7c2fbd0fbe626d819c8e5237d72c62 (diff)
downloadlinux-cd87a2d3a33d75a646f1aa1aa2ee5bf712d6f963.tar.gz
linux-cd87a2d3a33d75a646f1aa1aa2ee5bf712d6f963.tar.bz2
linux-cd87a2d3a33d75a646f1aa1aa2ee5bf712d6f963.zip
mac80211: fix use-after-free
commit 8c0c709eea5cbab97fb464cd68b06f24acc58ee1 Author: Johannes Berg <johannes@sipsolutions.net> Date: Wed Nov 25 17:46:15 2009 +0100 mac80211: move cmntr flag out of rx flags moved the CMTR flag into the skb's status, and in doing so introduced a use-after-free -- when the skb has been handed to cooked monitors the status setting will touch now invalid memory. Additionally, moving it there has effectively discarded the optimisation -- since the bit is only ever set on freed SKBs, and those were a copy, it could never be checked. For the current release, fixing this properly is a bit too involved, so let's just remove the problematic code and leave userspace with one copy of each frame for each virtual interface. Cc: stable@kernel.org [2.6.33+] Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
Diffstat (limited to 'drivers/net')
0 files changed, 0 insertions, 0 deletions