diff options
| author | Koen Vandeputte <koen.vandeputte@ncentric.com> | 2017-01-13 10:34:52 +0100 |
|---|---|---|
| committer | Felix Fietkau <nbd@nbd.name> | 2017-01-14 18:28:21 +0100 |
| commit | adf2fef5e8665e534d4895308d9e3325df7716ba (patch) | |
| tree | 27ea4f52e79589ba6fe75ed3c81745fb5839ecf2 /package/kernel/mac80211/patches/350-mac80211-init-fastxmit-later.patch | |
| parent | 5b089e45a649b936d5ce71930adef4fdea8a7875 (diff) | |
| download | upstream-adf2fef5e8665e534d4895308d9e3325df7716ba.tar.gz upstream-adf2fef5e8665e534d4895308d9e3325df7716ba.tar.bz2 upstream-adf2fef5e8665e534d4895308d9e3325df7716ba.zip | |
mac80211: backport some upstream fixes
Backports the following upstream fixes:
mac80211: initialize fast-xmit 'info' later
mac80211: fix legacy and invalid rx-rate report
mac80211: fix tid_agg_rx NULL dereference
Compiled and tested on: cns3xxx
Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>
Diffstat (limited to 'package/kernel/mac80211/patches/350-mac80211-init-fastxmit-later.patch')
| -rw-r--r-- | package/kernel/mac80211/patches/350-mac80211-init-fastxmit-later.patch | 41 |
1 files changed, 41 insertions, 0 deletions
diff --git a/package/kernel/mac80211/patches/350-mac80211-init-fastxmit-later.patch b/package/kernel/mac80211/patches/350-mac80211-init-fastxmit-later.patch new file mode 100644 index 0000000000..0b640efea9 --- /dev/null +++ b/package/kernel/mac80211/patches/350-mac80211-init-fastxmit-later.patch @@ -0,0 +1,41 @@ +From 35f432a03e41d3bf08c51ede917f94e2288fbe8c Mon Sep 17 00:00:00 2001 +From: Johannes Berg <johannes.berg@intel.com> +Date: Mon, 2 Jan 2017 11:19:29 +0100 +Subject: [PATCH] mac80211: initialize fast-xmit 'info' later + +In ieee80211_xmit_fast(), 'info' is initialized to point to the skb +that's passed in, but that skb may later be replaced by a clone (if +it was shared), leading to an invalid pointer. + +This can lead to use-after-free and also later crashes since the +real SKB's info->hw_queue doesn't get initialized properly. + +Fix this by assigning info only later, when it's needed, after the +skb replacement (may have) happened. + +Cc: stable@vger.kernel.org +Reported-by: Ben Greear <greearb@candelatech.com> +Signed-off-by: Johannes Berg <johannes.berg@intel.com> +--- + net/mac80211/tx.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/net/mac80211/tx.c ++++ b/net/mac80211/tx.c +@@ -3297,7 +3297,7 @@ static bool ieee80211_xmit_fast(struct i + int extra_head = fast_tx->hdr_len - (ETH_HLEN - 2); + int hw_headroom = sdata->local->hw.extra_tx_headroom; + struct ethhdr eth; +- struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb); ++ struct ieee80211_tx_info *info; + struct ieee80211_hdr *hdr = (void *)fast_tx->hdr; + struct ieee80211_tx_data tx; + ieee80211_tx_result r; +@@ -3361,6 +3361,7 @@ static bool ieee80211_xmit_fast(struct i + memcpy(skb->data + fast_tx->da_offs, eth.h_dest, ETH_ALEN); + memcpy(skb->data + fast_tx->sa_offs, eth.h_source, ETH_ALEN); + ++ info = IEEE80211_SKB_CB(skb); + memset(info, 0, sizeof(*info)); + info->band = fast_tx->band; + info->control.vif = &sdata->vif; |