diff options
| author |   damien <damien@openbsd.org> | 2006-08-10 09:23:32 +0000 |
|---|---|---|
| committer | damien <damien@openbsd.org> | 2006-08-10 09:23:32 +0000 |
| commit | 9d48dba9b9aa55ed7283fa670b6cf0f7865f204d (patch) | |
| tree | 6500fd76ebe063fd90c23357c1580eeda3b29a95 | |
| parent | failing qt4 test case. (diff) | |
| download | wireguard-openbsd-9d48dba9b9aa55ed7283fa670b6cf0f7865f204d.tar.xz wireguard-openbsd-9d48dba9b9aa55ed7283fa670b6cf0f7865f204d.zip | |
fix a use-after-free (read) of a mbuf in wpi_tx_intr().
| -rw-r--r-- | sys/dev/pci/if_wpi.c | 12 |
1 files changed, 6 insertions, 6 deletions
diff --git a/sys/dev/pci/if_wpi.c b/sys/dev/pci/if_wpi.c index 40297b7a6ba..083df73cf81 100644 --- a/sys/dev/pci/if_wpi.c +++ b/sys/dev/pci/if_wpi.c @@ -1,4 +1,4 @@ -/* $OpenBSD: if_wpi.c,v 1.27 2006/08/06 13:12:32 damien Exp $ */ +/* $OpenBSD: if_wpi.c,v 1.28 2006/08/10 09:23:32 damien Exp $ */ /*- * Copyright (c) 2006 @@ -1227,17 +1227,17 @@ wpi_tx_intr(struct wpi_softc *sc, struct wpi_rx_desc *desc) wn->amn.amn_retrycnt++; } - bus_dmamap_unload(sc->sc_dmat, data->map); + if ((letoh32(stat->status) & 0xff) != 1) + ifp->if_oerrors++; + else + ifp->if_opackets++; + bus_dmamap_unload(sc->sc_dmat, data->map); m_freem(data->m); data->m = NULL; ieee80211_release_node(ic, data->ni); data->ni = NULL; - if ((letoh32(stat->status) & 0xff) != 1) - ifp->if_oerrors++; - else - ifp->if_opackets++; ring->queued--; sc->sc_tx_timer = 0; |