mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-28 21:33:52 +00:00
staging: rtl8192u: Fix use after free in ieee80211_rx()
[ Upstream commitbcc5e2dcf0
] We cannot dereference the "skb" pointer after calling ieee80211_monitor_rx(), because it is a use after free. Fixes:8fc8598e61
("Staging: Added Realtek rtl8192u driver to staging") Signed-off-by: Dan Carpenter <error27@gmail.com> Link: https://lore.kernel.org/r/Y33BArx3k/aw6yv/@kili Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
parent
9e6fe3e856
commit
9c03db0ec8
1 changed files with 3 additions and 1 deletions
|
@ -965,9 +965,11 @@ int ieee80211_rx(struct ieee80211_device *ieee, struct sk_buff *skb,
|
||||||
#endif
|
#endif
|
||||||
|
|
||||||
if (ieee->iw_mode == IW_MODE_MONITOR) {
|
if (ieee->iw_mode == IW_MODE_MONITOR) {
|
||||||
|
unsigned int len = skb->len;
|
||||||
|
|
||||||
ieee80211_monitor_rx(ieee, skb, rx_stats);
|
ieee80211_monitor_rx(ieee, skb, rx_stats);
|
||||||
stats->rx_packets++;
|
stats->rx_packets++;
|
||||||
stats->rx_bytes += skb->len;
|
stats->rx_bytes += len;
|
||||||
return 1;
|
return 1;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
Loading…
Reference in a new issue