From: Eugene Teo <eugeneteo@kernel.sg>
Date: Mon, 21 May 2007 14:30:22 +0000 (+0800)
Subject: [PATCH] drivers/net/wireless/libertas/rx.c: fix use-after-free
X-Git-Tag: v2.6.22-rc3~12^2~9^2
X-Git-Url: https://err.no/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=412e8a0ebf1a58c060cc76438e5b6d33789c5e20;p=linux-2.6

[PATCH] drivers/net/wireless/libertas/rx.c: fix use-after-free

skb could have been freed by then. Also, in libertas_upload_rx_packet(),
skb->protocol is initialized by eth_type_trans().

Signed-off-by: Eugene Teo <eugeneteo@kernel.sg>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
---

diff --git a/drivers/net/wireless/libertas/rx.c b/drivers/net/wireless/libertas/rx.c
index b19b5aa871..96619a3295 100644
--- a/drivers/net/wireless/libertas/rx.c
+++ b/drivers/net/wireless/libertas/rx.c
@@ -441,7 +441,5 @@ static int process_rxed_802_11_packet(wlan_private * priv, struct sk_buff *skb)
 done:
 	LEAVE();
 
-	skb->protocol = __constant_htons(0x0019);	/* ETH_P_80211_RAW */
-
 	return (ret);
 }