The patch titled
drivers/net/wireless/libertas/rx.c: fix use-after-free
has been added to the -mm tree. Its filename is
drivers-net-wireless-libertas-rxc-fix.patch
*** Remember to use Documentation/SubmitChecklist when testing your code ***
See http://www.zip.com.au/~akpm/linux/patches/stuff/added-to-mm.txt to find
out what to do about this
------------------------------------------------------
Subject: drivers/net/wireless/libertas/rx.c: fix use-after-free
From: Eugene Teo <eugeneteo@xxxxxxxxx>
skb could have been freed by then. Also, in libertas_upload_rx_packet(),
skb->protocol is initialized by eth_type_trans().
Cc: John W. Linville <linville@xxxxxxxxxxxxx>
Signed-off-by: Eugene Teo <eugeneteo@xxxxxxxxx>
Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>
---
drivers/net/wireless/libertas/rx.c | 2 --
1 files changed, 2 deletions(-)
diff -puN drivers/net/wireless/libertas/rx.c~drivers-net-wireless-libertas-rxc-fix drivers/net/wireless/libertas/rx.c
--- a/drivers/net/wireless/libertas/rx.c~drivers-net-wireless-libertas-rxc-fix
+++ a/drivers/net/wireless/libertas/rx.c
@@ -453,7 +453,5 @@ static int process_rxed_802_11_packet(wl
done:
LEAVE();
- skb->protocol = __constant_htons(0x0019); /* ETH_P_80211_RAW */
-
return (ret);
}
_
Patches currently in -mm which might be from eugeneteo@xxxxxxxxx are
drivers-net-wireless-libertas-rxc-fix.patch
-
To unsubscribe from this list: send the line "unsubscribe mm-commits" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
