diff options
| author | Felix Fietkau <nbd@nbd.name> | 2020-01-13 19:21:07 +0100 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2020-01-23 08:19:41 +0100 |
| commit | 4a0a338548988d606d7f3a13a6a88cafdee78950 (patch) | |
| tree | 02fbc3e957b5cbeea34e858b8bfd62691cac1db7 | |
| parent | 3407f517389cf218a636f29f52fe4201075a1dbb (diff) | |
| download | linux-stable-4a0a338548988d606d7f3a13a6a88cafdee78950.tar.gz linux-stable-4a0a338548988d606d7f3a13a6a88cafdee78950.tar.bz2 linux-stable-4a0a338548988d606d7f3a13a6a88cafdee78950.zip | |
cfg80211: fix page refcount issue in A-MSDU decap
commit 81c044fc3bdc5b7be967cd3682528ea94b58c06a upstream.
The fragments attached to a skb can be part of a compound page. In that case,
page_ref_inc will increment the refcount for the wrong page. Fix this by
using get_page instead, which calls page_ref_inc on the compound head and
also checks for overflow.
Fixes: 2b67f944f88c ("cfg80211: reuse existing page fragments in A-MSDU rx")
Cc: stable@vger.kernel.org
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Link: https://lore.kernel.org/r/20200113182107.20461-1-nbd@nbd.name
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| -rw-r--r-- | net/wireless/util.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/net/wireless/util.c b/net/wireless/util.c index ecce7f8706b4..262922cf6a0c 100644 --- a/net/wireless/util.c +++ b/net/wireless/util.c @@ -653,7 +653,7 @@ __frame_add_frag(struct sk_buff *skb, struct page *page, struct skb_shared_info *sh = skb_shinfo(skb); int page_offset; - page_ref_inc(page); + get_page(page); page_offset = ptr - page_address(page); skb_add_rx_frag(skb, sh->nr_frags, page, page_offset, len, size); } |