Subject: [PATCH] bcm43xx-d80211: Fix DMA TX skb doublefree

From: Michael Buesch <[email-masked]>
Date: Thu, 21 Dec 2006 19:16:50 +0100

This fixes a possible double-free of the TX skb buffers.
Always NULL the pointer after freeing.

Signed-off-by: Michael Buesch <[email-masked]>

Index: wireless-dev/drivers/net/wireless/d80211/bcm43xx/bcm43xx_dma.c
===================================================================
--- wireless-dev.orig/drivers/net/wireless/d80211/bcm43xx/bcm43xx_dma.c	2006-12-07 17:25:19.000000000 +0100
+++ wireless-dev/drivers/net/wireless/d80211/bcm43xx/bcm43xx_dma.c	2006-12-21 19:05:28.000000000 +0100
@@ -388,6 +388,7 @@ void free_descriptor_buffer(struct bcm43
 			dev_kfree_skb_irq(meta->skb);
 		else
 			dev_kfree_skb(meta->skb);
+		meta->skb = NULL;
 	}
 }
 
@@ -1131,6 +1132,7 @@ void bcm43xx_dma_handle_txstatus(struct 
 			meta->txstat.retry_count = status->frame_count - 1;
 			ieee80211_tx_status_irqsafe(bcm->ieee, meta->skb, &(meta->txstat));
 			/* skb is freed by ieee80211_tx_status_irqsafe() */
+			meta->skb = NULL;
 		} else {
 			/* No need to call free_descriptor_buffer here, as
 			 * this is only the txhdr, which is not allocated.

-- 
Greetings Michael.