Merge tag 'nfc-fixes-3.7-2' of git://git.kernel.org/pub/scm/linux/kernel/git/sameo/nfc-3.0

This is an NFC LLCP fix for 3.7 and contains only one patch.

It fixes a potential crash when receiving an LLCP HDLC frame acking a frame
that is not the last sent one. In that case we may dereference an already
freed pointer.

2 files changed, 4 insertions, 3 deletions

diff --git a/net/mac80211/offchannel.c b/net/mac80211/offchannel.c
index 5abddfe3e101..a5379aea7d09 100644
--- a/net/mac80211/offchannel.c
+++ b/net/mac80211/offchannel.c
@@ -462,8 +462,6 @@ void ieee80211_roc_purge(struct ieee80211_sub_if_data *sdata)
                 list_move_tail(&roc->list, &tmp_list);
                 roc->abort = true;
         }
-
-        ieee80211_start_next_roc(local);
         mutex_unlock(&local->mtx);
 
         list_for_each_entry_safe(roc, tmp, &tmp_list, list) {
diff --git a/net/nfc/llcp/llcp.c b/net/nfc/llcp/llcp.c
index 2df87056c6df..ec43914c92a9 100644
--- a/net/nfc/llcp/llcp.c
+++ b/net/nfc/llcp/llcp.c
@@ -985,15 +985,18 @@ static void nfc_llcp_recv_hdlc(struct nfc_llcp_local *local,
         /* Remove skbs from the pending queue */
         if (llcp_sock->send_ack_n != nr) {
                 struct sk_buff *s, *tmp;
+                u8 n;
 
                 llcp_sock->send_ack_n = nr;
 
                 /* Remove and free all skbs until ns == nr */
                 skb_queue_walk_safe(&llcp_sock->tx_pending_queue, s, tmp) {
+                        n = nfc_llcp_ns(s);
+
                         skb_unlink(s, &llcp_sock->tx_pending_queue);
                         kfree_skb(s);
 
-                        if (nfc_llcp_ns(s) == nr)
+                        if (n == nr)
                                 break;
                 }