[PATCHv2 2/4] ath10k: make sure to not use invalid beacon pointer

Michal Kazior michal.kazior at tieto.com
Mon Apr 14 00:20:08 PDT 2014

If DMA mapping of next beacon failed it was
possible for next SWBA to access a pointer that
was already unmapped and freed. This could cause
memory corruption.

Signed-off-by: Michal Kazior <michal.kazior at tieto.com>
 * move arvif->beacon=NULL after dev_kfree_skb() [Kalle]

 drivers/net/wireless/ath/ath10k/wmi.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/wireless/ath/ath10k/wmi.c b/drivers/net/wireless/ath/ath10k/wmi.c
index fe4d5f1..11176cc 100644
--- a/drivers/net/wireless/ath/ath10k/wmi.c
+++ b/drivers/net/wireless/ath/ath10k/wmi.c
@@ -1431,6 +1431,7 @@ static void ath10k_wmi_event_host_swba(struct ath10k *ar, struct sk_buff *skb)
 					 arvif->beacon->len, DMA_TO_DEVICE);
+			arvif->beacon = NULL;
 		ATH10K_SKB_CB(bcn)->paddr = dma_map_single(arvif->ar->dev,

More information about the ath10k mailing list