Johannes Berg 9b73f43fce mac80211: initialize fast-xmit 'info' later
commit 35f432a03e41d3bf08c51ede917f94e2288fbe8c upstream.

In ieee80211_xmit_fast(), 'info' is initialized to point to the skb
that's passed in, but that skb may later be replaced by a clone (if
it was shared), leading to an invalid pointer.

This can lead to use-after-free and also later crashes since the
real SKB's info->hw_queue doesn't get initialized properly.

Fix this by assigning info only later, when it's needed, after the
skb replacement (may have) happened.

Reported-by: Ben Greear <greearb@candelatech.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-01-12 11:22:43 +01:00
..
2016-11-15 07:46:38 +01:00
2016-11-15 07:46:38 +01:00
2015-11-23 14:56:15 -05:00
2015-11-02 22:47:14 -05:00
2015-10-23 03:05:19 -07:00
2015-10-07 04:27:43 -07:00
2016-05-18 17:06:40 -07:00
2015-10-21 00:49:24 +02:00