Felix Fietkau bed37001b6 ath9k: fix double-free bug on beacon generate failure ...

commit 1adb2e2b5f upstream.

When the next beacon is sent, the ath_buf from the previous run is reused.
If getting a new beacon from mac80211 fails, bf->bf_mpdu is not reset, yet
the skb is freed, leading to a double-free on the next beacon tx attempt,
resulting in a system crash.

Signed-off-by: Felix Fietkau <nbd@openwrt.org>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2013-02-03 18:21:37 -06:00

..

ath

ath9k: fix double-free bug on beacon generate failure

2013-02-03 18:21:37 -06:00

b43

b43: refuse to load unsupported firmware

2011-11-21 14:31:22 -08:00

b43legacy

b43legacy: Fix crash on unload when firmware not available

2012-10-07 08:27:25 -07:00

hostap

net: Audit drivers to identify those needing IFF_TX_SKB_SHARING cleared

2011-08-15 18:31:38 -07:00

ipw2x00

ipw2200: Fix race condition in the command completion acknowledge

2012-05-07 08:56:40 -07:00

iwlegacy

iwl3945: fix possible il->txq NULL pointer dereference in delayed works

2012-03-23 11:20:52 -07:00

iwlwifi

iwlwifi: don't mess up the SCD when removing a key

2012-06-17 11:23:12 -07:00

iwmc3200wifi

Merge ssh://master.kernel.org/pub/scm/linux/kernel/git/linville/wireless-next-2.6 into for-davem

2011-05-24 16:47:54 -04:00

libertas

Net, libertas: Resolve memory leak in if_spi_host_to_card()

2011-11-26 09:09:54 -08:00

libertas_tf

mac80211: make tx() operation return void

2011-02-25 15:32:34 -05:00

mwifiex

mwifiex: report error to MMC core if we cannot suspend

2012-12-03 12:59:13 -08:00

orinoco

pcmcia: Convert pcmcia_device_id declarations to const

2011-05-06 07:46:22 +02:00

p54

p54usb: add USBIDs for two more p54usb devices

2013-01-11 09:03:37 -08:00

prism54

Fix common misspellings

2011-03-31 11:26:23 -03:00

rt2x00

rt2800: validate step value for temperature compensation

2012-11-17 13:14:20 -08:00

rtl818x

USB: rtl8187: remove __devinit* from the struct usb_device_id table

2012-09-14 10:00:40 -07:00

rtlwifi

rtlwifi: rtl8192cu: Add new USB ID

2012-12-03 12:59:13 -08:00

wl12xx

wl12xx: Check buffer bound when processing nvs data

2012-01-12 11:35:02 -08:00

wl1251

wl1251: fix oops on early interrupt

2012-06-10 00:33:05 +09:00

zd1211rw

zd1211rw: fix to work on OHCI

2011-05-31 14:47:26 -04:00

adm8211.c

mac80211: make tx() operation return void

2011-02-25 15:32:34 -05:00

adm8211.h

…

airo_cs.c

pcmcia: Convert pcmcia_device_id declarations to const

2011-05-06 07:46:22 +02:00

airo.c

net: Audit drivers to identify those needing IFF_TX_SKB_SHARING cleared

2011-08-15 18:31:38 -07:00

airo.h

…

at76c50x-usb.c

at76c50x-usb: fix warning caused by at76_mac80211_tx now returning void

2011-02-28 13:57:30 -05:00

at76c50x-usb.h

ieee80211: add IEEE80211_COUNTRY_STRING_LEN definition

2011-03-09 16:10:56 -05:00

atmel_cs.c

pcmcia: Convert pcmcia_device_id declarations to const

2011-05-06 07:46:22 +02:00

atmel_pci.c

…

atmel.c

Fix common misspellings

2011-03-31 11:26:23 -03:00

atmel.h

…

Kconfig

wireless: mwifiex: initial commit for Marvell mwifiex driver

2011-03-30 14:15:17 -04:00

mac80211_hwsim.c

net: call dev_alloc_name from register_netdevice

2011-05-05 10:57:45 -07:00

Makefile

wireless: mwifiex: initial commit for Marvell mwifiex driver

2011-03-30 14:15:17 -04:00

mwl8k.c

mwl8k: Tell firmware to generate CCMP header

2011-06-15 08:13:03 -04:00

ray_cs.c

pcmcia: Convert pcmcia_device_id declarations to const

2011-05-06 07:46:22 +02:00

ray_cs.h

…

rayctl.h

Fix common misspellings

2011-03-31 11:26:23 -03:00

rndis_wlan.c

cfg80211: Use consistent BSS matching between scan and sme

2011-05-19 10:37:18 -04:00

wl3501_cs.c

pcmcia: Convert pcmcia_device_id declarations to const

2011-05-06 07:46:22 +02:00

wl3501.h

…

zd1201.c

…

zd1201.h

…