mac80211: Don't access sk_queue_head->next directly.
authorDavid S. Miller <davem@davemloft.net>
Tue, 7 Aug 2018 05:49:13 +0000 (22:49 -0700)
committerDavid S. Miller <davem@davemloft.net>
Mon, 10 Sep 2018 17:06:53 +0000 (10:06 -0700)
Use __skb_peek() instead.

Signed-off-by: David S. Miller <davem@davemloft.net>
net/mac80211/rx.c

index c6bfd40..a0ca27a 100644 (file)
@@ -2077,6 +2077,7 @@ ieee80211_reassemble_find(struct ieee80211_sub_if_data *sdata,
        idx = sdata->fragment_next;
        for (i = 0; i < IEEE80211_FRAGMENT_MAX; i++) {
                struct ieee80211_hdr *f_hdr;
+               struct sk_buff *f_skb;
 
                idx--;
                if (idx < 0)
@@ -2088,7 +2089,8 @@ ieee80211_reassemble_find(struct ieee80211_sub_if_data *sdata,
                    entry->last_frag + 1 != frag)
                        continue;
 
-               f_hdr = (struct ieee80211_hdr *)entry->skb_list.next->data;
+               f_skb = __skb_peek(&entry->skb_list);
+               f_hdr = (struct ieee80211_hdr *) f_skb->data;
 
                /*
                 * Check ftype and addresses are equal, else check next fragment