[wireless-2.6] mac80211: fix use-after-free

Commit Message

Johannes Berg Sept. 24, 2010, 9:20 a.m. UTC

None

Patch

--- iwlwifi-jo.orig/net/mac80211/rx.c	2010-09-24 11:13:33.000000000 +0200
+++ iwlwifi-jo/net/mac80211/rx.c	2010-09-24 11:14:28.000000000 +0200
@@ -2199,9 +2199,6 @@  static void ieee80211_rx_cooked_monitor(
 	struct net_device *prev_dev = NULL;
 	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
 
-	if (status->flag & RX_FLAG_INTERNAL_CMTR)
-		goto out_free_skb;
-
 	if (skb_headroom(skb) < sizeof(*rthdr) &&
 	    pskb_expand_head(skb, sizeof(*rthdr), 0, GFP_ATOMIC))
 		goto out_free_skb;
@@ -2260,7 +2257,6 @@  static void ieee80211_rx_cooked_monitor(
 	} else
 		goto out_free_skb;
 
-	status->flag |= RX_FLAG_INTERNAL_CMTR;
 	return;
 
  out_free_skb: