diff options
| author |   stsp <stsp@openbsd.org> | 2020-12-10 12:52:49 +0000 |
|---|---|---|
| committer | stsp <stsp@openbsd.org> | 2020-12-10 12:52:49 +0000 |
| commit | d0faa20ec7872ce2c90ae0b877daee4daf471053 (patch) | |
| tree | 75ab32c50a103124e73e811f67bcb5f3aec6b840 | |
| parent | use jiffies var instead of ticks when checking for timeout (diff) | |
| download | wireguard-openbsd-d0faa20ec7872ce2c90ae0b877daee4daf471053.tar.xz wireguard-openbsd-d0faa20ec7872ce2c90ae0b877daee4daf471053.zip | |
Fix double-free on error in ieee80211_amsdu_decap().
Bug was introduced by my previous commit to this file.
ok tobhe@
| -rw-r--r-- | sys/net80211/ieee80211_input.c | 10 |
1 files changed, 5 insertions, 5 deletions
diff --git a/sys/net80211/ieee80211_input.c b/sys/net80211/ieee80211_input.c index 924608b6724..5c8f88bd13a 100644 --- a/sys/net80211/ieee80211_input.c +++ b/sys/net80211/ieee80211_input.c @@ -1,4 +1,4 @@ -/* $OpenBSD: ieee80211_input.c,v 1.227 2020/12/09 21:54:11 stsp Exp $ */ +/* $OpenBSD: ieee80211_input.c,v 1.228 2020/12/10 12:52:49 stsp Exp $ */ /*- * Copyright (c) 2001 Atsushi Onoe @@ -1158,7 +1158,7 @@ ieee80211_amsdu_decap(struct ieee80211com *ic, struct mbuf *m, m = m_pullup(m, ETHER_HDR_LEN + LLC_SNAPFRAMELEN); if (m == NULL) { ic->ic_stats.is_rx_decap++; - break; + return; } eh = mtod(m, struct ether_header *); /* examine 802.3 header */ @@ -1168,7 +1168,7 @@ ieee80211_amsdu_decap(struct ieee80211com *ic, struct mbuf *m, /* stop processing A-MSDU subframes */ ic->ic_stats.is_rx_decap++; m_freem(m); - break; + return; } llc = (struct llc *)&eh[1]; /* examine 802.2 LLC header */ @@ -1192,7 +1192,7 @@ ieee80211_amsdu_decap(struct ieee80211com *ic, struct mbuf *m, DPRINTF(("A-MSDU subframe too long (%d)\n", len)); ic->ic_stats.is_rx_decap++; m_freem(m); - break; + return; } /* "detach" our A-MSDU subframe from the others */ @@ -1201,7 +1201,7 @@ ieee80211_amsdu_decap(struct ieee80211com *ic, struct mbuf *m, /* stop processing A-MSDU subframes */ ic->ic_stats.is_rx_decap++; m_freem(m); - break; + return; } ieee80211_enqueue_data(ic, m, ni, mcast, ml); |