diff options
| author | Damien Bergamini <damien@cvs.openbsd.org> | 2006-08-10 09:23:33 +0000 |
|---|---|---|
| committer | Damien Bergamini <damien@cvs.openbsd.org> | 2006-08-10 09:23:33 +0000 |
| commit | ccc8373cc23b1c83d4cb81fbaacaf42dfa976b41 (patch) | |
| tree | 1d81dfedd24049670d7ed96fe3b2f0207dc590eb /sys/dev/pci/if_wpi.c | |
| parent | df3042c746045dfbcec74e520cb3c7539a112c61 (diff) | |
fix a use-after-free (read) of a mbuf in wpi_tx_intr().
Diffstat (limited to 'sys/dev/pci/if_wpi.c')
| -rw-r--r-- | sys/dev/pci/if_wpi.c | 12 |
1 files changed, 6 insertions, 6 deletions
diff --git a/sys/dev/pci/if_wpi.c b/sys/dev/pci/if_wpi.c index 40297b7a6ba..083df73cf81 100644 --- a/sys/dev/pci/if_wpi.c +++ b/sys/dev/pci/if_wpi.c @@ -1,4 +1,4 @@ -/* $OpenBSD: if_wpi.c,v 1.27 2006/08/06 13:12:32 damien Exp $ */ +/* $OpenBSD: if_wpi.c,v 1.28 2006/08/10 09:23:32 damien Exp $ */ /*- * Copyright (c) 2006 @@ -1227,17 +1227,17 @@ wpi_tx_intr(struct wpi_softc *sc, struct wpi_rx_desc *desc) wn->amn.amn_retrycnt++; } - bus_dmamap_unload(sc->sc_dmat, data->map); + if ((letoh32(stat->status) & 0xff) != 1) + ifp->if_oerrors++; + else + ifp->if_opackets++; + bus_dmamap_unload(sc->sc_dmat, data->map); m_freem(data->m); data->m = NULL; ieee80211_release_node(ic, data->ni); data->ni = NULL; - if ((letoh32(stat->status) & 0xff) != 1) - ifp->if_oerrors++; - else - ifp->if_opackets++; ring->queued--; sc->sc_tx_timer = 0; |