[PATCH] drivers/net/wireless/libertas/rx.c: fix use-after-free
authorEugene Teo <eugeneteo@kernel.sg>
Mon, 21 May 2007 14:30:22 +0000 (22:30 +0800)
committerJohn W. Linville <linville@tuxdriver.com>
Tue, 22 May 2007 15:02:29 +0000 (11:02 -0400)
skb could have been freed by then. Also, in libertas_upload_rx_packet(),
skb->protocol is initialized by eth_type_trans().

Signed-off-by: Eugene Teo <eugeneteo@kernel.sg>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
drivers/net/wireless/libertas/rx.c

index b19b5aa8713bcb8a31c243a9a94fc574ec0f5f31..96619a32951bc9dc14904dd3267c13c25d5f7189 100644 (file)
@@ -441,7 +441,5 @@ static int process_rxed_802_11_packet(wlan_private * priv, struct sk_buff *skb)
 done:
        LEAVE();
 
-       skb->protocol = __constant_htons(0x0019);       /* ETH_P_80211_RAW */
-
        return (ret);
 }