diff options
| author | Felix Fietkau <nbd@nbd.name> | 2020-01-13 19:43:40 +0100 |
|---|---|---|
| committer | Felix Fietkau <nbd@nbd.name> | 2020-01-14 14:56:59 +0100 |
| commit | 9501469e1146c6d76b7dde6391479314897ba4d8 (patch) | |
| tree | 0081d4eba08d394ebc94f1e54e2049f5761414c5 /package | |
| parent | d5b3024139089e38f57bd1827273d7fba8497635 (diff) | |
| download | upstream-9501469e1146c6d76b7dde6391479314897ba4d8.tar.gz upstream-9501469e1146c6d76b7dde6391479314897ba4d8.tar.bz2 upstream-9501469e1146c6d76b7dde6391479314897ba4d8.zip | |
mac80211: fix a page refcounting issue leading to leaks/crashes in rx A-MSDU decap
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Diffstat (limited to 'package')
| -rw-r--r-- | package/kernel/mac80211/patches/subsys/352-cfg80211-fix-page-refcount-issue-in-A-MSDU-decap.patch | 25 |
1 files changed, 25 insertions, 0 deletions
diff --git a/package/kernel/mac80211/patches/subsys/352-cfg80211-fix-page-refcount-issue-in-A-MSDU-decap.patch b/package/kernel/mac80211/patches/subsys/352-cfg80211-fix-page-refcount-issue-in-A-MSDU-decap.patch new file mode 100644 index 0000000000..b7a291cc46 --- /dev/null +++ b/package/kernel/mac80211/patches/subsys/352-cfg80211-fix-page-refcount-issue-in-A-MSDU-decap.patch @@ -0,0 +1,25 @@ +From: Felix Fietkau <nbd@nbd.name> +Date: Mon, 13 Jan 2020 18:34:31 +0100 +Subject: [PATCH] cfg80211: fix page refcount issue in A-MSDU decap + +The fragments attached to a skb can be part of a compound page. In that case, +page_ref_inc will increment the refcount for the wrong page. Fix this by +using get_page instead, which calls page_ref_inc on the compound head and +also checks for overflow. + +Fixes: 2b67f944f88c ("cfg80211: reuse existing page fragments in A-MSDU rx") +Cc: stable@vger.kernel.org +Signed-off-by: Felix Fietkau <nbd@nbd.name> +--- + +--- a/net/wireless/util.c ++++ b/net/wireless/util.c +@@ -564,7 +564,7 @@ __frame_add_frag(struct sk_buff *skb, st + struct skb_shared_info *sh = skb_shinfo(skb); + int page_offset; + +- page_ref_inc(page); ++ get_page(page); + page_offset = ptr - page_address(page); + skb_add_rx_frag(skb, sh->nr_frags, page, page_offset, len, size); + } |