diff options
| author | Michal Kazior <[email protected]> | 2014-05-14 16:23:31 +0300 |
|---|---|---|
| committer | Kalle Valo <[email protected]> | 2014-05-14 16:40:47 +0300 |
| commit | 3e841fd0a54745c8ad24ecfb0303c505b7460ffb (patch) | |
| tree | e53cf63c1784fbfb497ff6adcf1e97d83e01aedb /net/lapb/lapb_timer.c | |
| parent | e21353576df1fae38710bdbff1c3abfe49f651cd (diff) | |
ath10k: fix htt rx ring clean up
msdu_payId was read before txrx tasklet was killed
so it was possible to end up using an invalid
sk_buff pointer leading to a panic.
Make sure to sanitize rx ring sk_buff pointers and
make the clean up go through all possible entries
and not rely on coherent-DMA mapped u32 index
which could be (in theory) corrupted by the device
as well.
Reported-By: Avery Pennarun <[email protected]>
Reported-By: Ben Greear <[email protected]>
Signed-off-by: Michal Kazior <[email protected]>
Signed-off-by: Kalle Valo <[email protected]>
Diffstat (limited to 'net/lapb/lapb_timer.c')
0 files changed, 0 insertions, 0 deletions