Stanislaw Gruszka 51028920a9 iwlwifi: fix skb usage after free ...

commit b25026981a upstream.

Since

commit a120e912eb
Author: Stanislaw Gruszka <sgruszka@redhat.com>
Date:   Fri Feb 19 15:47:33 2010 -0800

    iwlwifi: sanity check before counting number of tfds can be free

we use skb->data after calling ieee80211_tx_status_irqsafe(), which
could free skb instantly.

On current kernels I do not observe practical problems related with
bug, but on 2.6.35.y it cause random system hangs when stressing
wireless link.

Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
Acked-by: Wey-Yi Guy <wey-yi.w.guy@intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

2011-05-09 15:55:41 -07:00

..

ath

ath: add missing regdomain pair 0x5c mapping

2011-05-09 15:54:46 -07:00

b43

wireless: b43: fix error path in SDIO

2011-05-09 15:55:40 -07:00

b43legacy

b43/b43legacy: Wake queues in wireless_core_start

2010-03-15 08:50:00 -07:00

hostap

hostap_cs: fix sleeping function called from invalid context

2011-02-17 15:37:09 -08:00

ipw2x00

ipw2100: fix rebooting hang with driver loaded

2009-12-18 14:05:31 -08:00

iwlwifi

iwlwifi: fix skb usage after free

2011-05-09 15:55:41 -07:00

iwmc3200wifi

iwmc3200wifi: fix array out-of-boundary access

2010-01-06 15:04:03 -08:00

libertas

libertas/sdio: 8686: set ECSI bit for 1-bit transfers

2010-08-02 10:21:25 -07:00

libertas_tf

mac80211: allow configure_filter callback to sleep

2009-08-20 11:35:58 -04:00

orinoco

orinoco: clear countermeasure setting on commit

2011-01-07 14:43:08 -08:00

p54

p54: Initialize extra_len in p54_tx_80211

2011-05-09 15:54:46 -07:00

prism54

headers: remove sched.h from interrupt.h

2009-10-11 11:20:58 -07:00

rt2x00

rt2500usb: fallback to SW encryption for TKIP+AES

2011-05-09 15:55:40 -07:00

rtl818x

rtl8180: fix tx status reporting

2010-07-05 11:10:28 -07:00

wl12xx

wl1251: fix a memory leak in probe

2010-07-05 11:11:13 -07:00

zd1211rw

Merge branch 'master' of /home/davem/src/GIT/linux-2.6/

2009-09-24 15:13:11 -07:00

adm8211.c

mac80211: allow configure_filter callback to sleep

2009-08-20 11:35:58 -04:00

adm8211.h

mac80211: fix ADM8211_SYNCTL_RFtype define

2009-10-07 16:33:51 -04:00

airo_cs.c

…

airo.c

airo: fix setting zero length WEP key

2010-03-15 08:49:37 -07:00

airo.h

…

arlan-main.c

wireless: convert drivers to netdev_tx_t

2009-09-01 01:14:04 -07:00

arlan-proc.c

sysctl: remove "struct file *" argument of ->proc_handler

2009-09-24 07:21:04 -07:00

arlan.h

…

at76c50x-usb.c

mac80211: remove deprecated API

2009-08-20 11:35:58 -04:00

at76c50x-usb.h

…

atmel_cs.c

…

atmel_pci.c

…

atmel.c

trivial: fix typos "man[ae]g?ment" -> "management"

2009-09-21 15:14:56 +02:00

atmel.h

…

i82586.h

…

i82593.h

…

Kconfig

Kconfig: STRIP: Remove stale bits of STRIP help text

2009-10-01 14:49:14 -07:00

mac80211_hwsim.c

mac80211_hwsim: Fix initial beacon timer configuration

2009-09-29 17:25:16 -04:00

Makefile

…

mwl8k.c

mwl8k: separate driver and device info reporting during probe

2009-08-28 14:40:42 -04:00

netwave_cs.c

wireless: convert drivers to netdev_tx_t

2009-09-01 01:14:04 -07:00

ray_cs.c

ray_cs: Fix copy_from_user handling

2009-10-29 09:01:07 -07:00

ray_cs.h

…

rayctl.h

…

rndis_wlan.c

rndis_wlan: disable stall workaround

2010-03-15 08:49:43 -07:00

strip.c

wireless: convert drivers to netdev_tx_t

2009-09-01 01:14:04 -07:00

wavelan_cs.c

wireless: convert drivers to netdev_tx_t

2009-09-01 01:14:04 -07:00

wavelan_cs.h

…

wavelan_cs.p.h

wireless: convert drivers to netdev_tx_t

2009-09-01 01:14:04 -07:00

wavelan.c

wireless: convert drivers to netdev_tx_t

2009-09-01 01:14:04 -07:00

wavelan.h

…

wavelan.p.h

wireless: convert drivers to netdev_tx_t

2009-09-01 01:14:04 -07:00

wl3501_cs.c

wireless: convert drivers to netdev_tx_t

2009-09-01 01:14:04 -07:00

wl3501.h

…

zd1201.c

wireless: convert drivers to netdev_tx_t

2009-09-01 01:14:04 -07:00

zd1201.h

…