diff options
| author | David S. Miller <davem@davemloft.net> | 2018-08-06 22:49:13 -0700 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2018-09-10 10:06:53 -0700 |
| commit | 7957a9dea8bf58b02e6ebf28f91c4bce74b5c91c (patch) | |
| tree | 5c908bd6fd2d868f01fd14cad8b640ca07c771b7 | |
| parent | 8b69bd7d8a8927d537f134c37bcca6cbfa58e1b2 (diff) | |
mac80211: Don't access sk_queue_head->next directly.
Use __skb_peek() instead.
Signed-off-by: David S. Miller <davem@davemloft.net>
| -rw-r--r-- | net/mac80211/rx.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c index c6bfd4019d44..a0ca27aeb732 100644 --- a/net/mac80211/rx.c +++ b/net/mac80211/rx.c @@ -2077,6 +2077,7 @@ ieee80211_reassemble_find(struct ieee80211_sub_if_data *sdata, idx = sdata->fragment_next; for (i = 0; i < IEEE80211_FRAGMENT_MAX; i++) { struct ieee80211_hdr *f_hdr; + struct sk_buff *f_skb; idx--; if (idx < 0) @@ -2088,7 +2089,8 @@ ieee80211_reassemble_find(struct ieee80211_sub_if_data *sdata, entry->last_frag + 1 != frag) continue; - f_hdr = (struct ieee80211_hdr *)entry->skb_list.next->data; + f_skb = __skb_peek(&entry->skb_list); + f_hdr = (struct ieee80211_hdr *) f_skb->data; /* * Check ftype and addresses are equal, else check next fragment |