From: David S. Miller <davem@davemloft.net>
Date: Tue, 7 Aug 2018 05:49:13 +0000 (-0700)
Subject: mac80211: Don't access sk_queue_head->next directly.
X-Git-Url: http://git.cdn.openwrt.org/?a=commitdiff_plain;h=7957a9dea8bf58b02e6ebf28f91c4bce74b5c91c;p=openwrt%2Fstaging%2Fblogic.git

mac80211: Don't access sk_queue_head->next directly.

Use __skb_peek() instead.

Signed-off-by: David S. Miller <davem@davemloft.net>
---

diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index c6bfd4019d44..a0ca27aeb732 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -2077,6 +2077,7 @@ ieee80211_reassemble_find(struct ieee80211_sub_if_data *sdata,
 	idx = sdata->fragment_next;
 	for (i = 0; i < IEEE80211_FRAGMENT_MAX; i++) {
 		struct ieee80211_hdr *f_hdr;
+		struct sk_buff *f_skb;
 
 		idx--;
 		if (idx < 0)
@@ -2088,7 +2089,8 @@ ieee80211_reassemble_find(struct ieee80211_sub_if_data *sdata,
 		    entry->last_frag + 1 != frag)
 			continue;
 
-		f_hdr = (struct ieee80211_hdr *)entry->skb_list.next->data;
+		f_skb = __skb_peek(&entry->skb_list);
+		f_hdr = (struct ieee80211_hdr *) f_skb->data;
 
 		/*
 		 * Check ftype and addresses are equal, else check next fragment