aboutsummaryrefslogtreecommitdiffstats
path: root/package/kernel/mac80211
diff options
context:
space:
mode:
authorFelix Fietkau <nbd@nbd.name>2018-10-11 18:48:35 +0200
committerFelix Fietkau <nbd@nbd.name>2018-10-11 18:48:35 +0200
commit4fa4b5edaf79a3574e1485ebb04ba7e0d2289d63 (patch)
tree69a6494b436c79d0c18297776acd9cfa87d0715c /package/kernel/mac80211
parent70cb2d20c9f5dff7c1f3344812fd0d1ac06e911d (diff)
downloadupstream-4fa4b5edaf79a3574e1485ebb04ba7e0d2289d63.tar.gz
upstream-4fa4b5edaf79a3574e1485ebb04ba7e0d2289d63.tar.bz2
upstream-4fa4b5edaf79a3574e1485ebb04ba7e0d2289d63.zip
mac80211: fix A-MSDU packet handling with TCP retransmission
Improves local TCP throughput and fixes use-after-free bugs that could lead to crashes. Signed-off-by: Felix Fietkau <nbd@nbd.name>
Diffstat (limited to 'package/kernel/mac80211')
-rw-r--r--package/kernel/mac80211/patches/396-mac80211-free-skb-fraglist-before-freeing-the-skb.patch31
1 files changed, 31 insertions, 0 deletions
diff --git a/package/kernel/mac80211/patches/396-mac80211-free-skb-fraglist-before-freeing-the-skb.patch b/package/kernel/mac80211/patches/396-mac80211-free-skb-fraglist-before-freeing-the-skb.patch
new file mode 100644
index 0000000000..4819dfc648
--- /dev/null
+++ b/package/kernel/mac80211/patches/396-mac80211-free-skb-fraglist-before-freeing-the-skb.patch
@@ -0,0 +1,31 @@
+From: Sara Sharon <sara.sharon@intel.com>
+Date: Thu, 11 Oct 2018 14:21:21 +0200
+Subject: [PATCH] mac80211: free skb fraglist before freeing the skb
+
+mac80211 uses the frag list to build AMSDU. When freeing
+the skb, it may not be really freed, since someone is still
+holding a reference to it.
+In that case, when TCP skb is being retransmitted, the
+pointer to the frag list is being reused, while the data
+in there is no longer valid.
+Since we will never get frag list from the network stack,
+as mac80211 doesn't advertise the capability, we can safely
+free and nullify it before releasing the SKB.
+
+Signed-off-by: Sara Sharon <sara.sharon@intel.com>
+---
+
+--- a/net/mac80211/status.c
++++ b/net/mac80211/status.c
+@@ -550,6 +550,11 @@ static void ieee80211_report_used_skb(st
+ }
+
+ ieee80211_led_tx(local);
++
++ if (skb_has_frag_list(skb)) {
++ kfree_skb_list(skb_shinfo(skb)->frag_list);
++ skb_shinfo(skb)->frag_list = NULL;
++ }
+ }
+
+ /*