Johannes Berg 35f432a03e mac80211: initialize fast-xmit 'info' later
In ieee80211_xmit_fast(), 'info' is initialized to point to the skb
that's passed in, but that skb may later be replaced by a clone (if
it was shared), leading to an invalid pointer.

This can lead to use-after-free and also later crashes since the
real SKB's info->hw_queue doesn't get initialized properly.

Fix this by assigning info only later, when it's needed, after the
skb replacement (may have) happened.

Cc: stable@vger.kernel.org
Reported-by: Ben Greear <greearb@candelatech.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2017-01-02 11:28:25 +01:00
..
2014-11-04 13:18:21 +01:00
2014-04-09 14:49:43 +02:00
2016-04-12 15:56:15 +02:00
2015-08-14 17:49:53 +02:00
2015-05-11 19:16:04 +02:00
2016-09-30 13:47:00 +02:00
2014-04-09 14:49:43 +02:00
2016-09-13 15:39:29 +02:00
2016-04-12 15:56:15 +02:00
2016-09-15 16:46:16 +02:00
2015-05-11 14:51:29 +02:00