diff options
| author |   David S. Miller <davem@davemloft.net> | 2019-09-26 18:00:26 +0200 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2019-09-26 18:00:26 +0200 |
| commit | 5a2a828d81e9aa2a44df48414b1ac40b572f0b44 (patch) | |
| tree | a64882979c5fce37c5e83c0ab47fed2e74e2aa78 /drivers/net/wireless/ath | |
| parent | ipv6: do not free rt if FIB_LOOKUP_NOREF is set on suppress rule (diff) | |
| parent | wil6210: use after free in wil_netif_rx_any() (diff) | |
| download | linux-dev-5a2a828d81e9aa2a44df48414b1ac40b572f0b44.tar.xz linux-dev-5a2a828d81e9aa2a44df48414b1ac40b572f0b44.zip | |
Merge tag 'wireless-drivers-for-davem-2019-09-26' of https://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers
Kalle Valo says:
====================
wireless-drivers fixes for 5.4
First set of fixes for 5.4 sent during the merge window. Most are
regressions fixes but the mt7615 problem has been since it was merged.
iwlwifi
* fix a build regression related CONFIG_THERMAL
* avoid using GEO_TX_POWER_LIMIT command on certain firmware versions
rtw88
* fixes for skb leaks
zd1211rw
* fix a compiler warning on 32 bit
mt76
* fix the firmware paths for mt7615 to match with linux-firmware
wil6210
* fix use of skb after free
====================
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers/net/wireless/ath')
| -rw-r--r-- | drivers/net/wireless/ath/wil6210/txrx.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/net/wireless/ath/wil6210/txrx.c b/drivers/net/wireless/ath/wil6210/txrx.c index cb13652491ad..598c1fba9dac 100644 --- a/drivers/net/wireless/ath/wil6210/txrx.c +++ b/drivers/net/wireless/ath/wil6210/txrx.c @@ -1012,11 +1012,11 @@ void wil_netif_rx_any(struct sk_buff *skb, struct net_device *ndev) skb_orphan(skb); if (security && (wil->txrx_ops.rx_crypto_check(wil, skb) != 0)) { + wil_dbg_txrx(wil, "Rx drop %d bytes\n", skb->len); dev_kfree_skb(skb); ndev->stats.rx_dropped++; stats->rx_replay++; stats->rx_dropped++; - wil_dbg_txrx(wil, "Rx drop %d bytes\n", skb->len); return; } |