From: Lorenzo Bianconi lorenzo@kernel.org
[ Upstream commit 223cea6d3c974acd393bfac2d168b2945a6cf1e5 ]
Get rid of an undefined behaviour in mt76_testmode_alloc_skb routine allocating skb frames
Fixes: 2601dda8faa76 ("mt76: testmode: add support to send larger packet") Signed-off-by: Lorenzo Bianconi lorenzo@kernel.org Signed-off-by: Felix Fietkau nbd@nbd.name Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/net/wireless/mediatek/mt76/testmode.c | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-)
diff --git a/drivers/net/wireless/mediatek/mt76/testmode.c b/drivers/net/wireless/mediatek/mt76/testmode.c index f40387a866ee..f614c887f323 100644 --- a/drivers/net/wireless/mediatek/mt76/testmode.c +++ b/drivers/net/wireless/mediatek/mt76/testmode.c @@ -168,12 +168,8 @@ int mt76_testmode_alloc_skb(struct mt76_phy *phy, u32 len) head->len += frag->len; head->data_len += frag->len;
- if (*frag_tail) { - (*frag_tail)->next = frag; - frag_tail = &frag; - } else { - *frag_tail = frag; - } + *frag_tail = frag; + frag_tail = &(*frag_tail)->next; }
mt76_testmode_free_skb(phy);