From 431e708829b2f1e3960c1af281eb3192fdd1d10a Mon Sep 17 00:00:00 2001
From: Johannes Berg <johannes.berg@intel.com>
Date: Wed, 7 Nov 2012 14:02:30 +0100
Subject: [PATCH] mac80211: fix TX error path
One error path in ieee80211_subif_start_xmit() will
double-free the SKB. Set it to NULL to prevent that.
This issue was introduced by my channel context
changes.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
---
net/mac80211/tx.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 065f81cb56183..b5468876287e7 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -2089,6 +2089,7 @@ netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
head_need = max_t(int, 0, head_need);
if (ieee80211_skb_resize(sdata, skb, head_need, true)) {
ieee80211_free_txskb(&local->hw, skb);
+ skb = NULL;
goto fail_rcu;
}
}
--
2.39.5