diff options
| author | Emmanuel Grumbach <emmanuel.grumbach@intel.com> | 2019-07-22 13:02:25 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2019-08-16 10:11:11 +0200 |
| commit | a985a6b398d6054f5abf048cba18c30d3cffd8a0 (patch) | |
| tree | bd335e31a22a0543854e27bbc7e28353c6aad62a | |
| parent | 54ae6149f4cb0ae9c622ba2ef9cb908446ed8c45 (diff) | |
| download | linux-stable-a985a6b398d6054f5abf048cba18c30d3cffd8a0.tar.gz linux-stable-a985a6b398d6054f5abf048cba18c30d3cffd8a0.tar.bz2 linux-stable-a985a6b398d6054f5abf048cba18c30d3cffd8a0.zip | |
iwlwifi: mvm: fix a use-after-free bug in iwl_mvm_tx_tso_segment
commit 71b256f8f7a5c09810d2c3ed6165629c2cc0a652 upstream.
Accessing the hdr of an skb that was consumed already isn't
a good idea.
First ask if the skb is a QoS packet, then keep that data
on stack, and then consume the skb.
This was spotted by KASAN.
Cc: stable@vger.kernel.org
Fixes: 08f7d8b69aaf ("iwlwifi: mvm: bring back mvm GSO code")
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| -rw-r--r-- | drivers/net/wireless/intel/iwlwifi/mvm/tx.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c index 96f8d38ea321..a12ee20fb9ab 100644 --- a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c +++ b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c @@ -831,6 +831,7 @@ iwl_mvm_tx_tso_segment(struct sk_buff *skb, unsigned int num_subframes, unsigned int tcp_payload_len; unsigned int mss = skb_shinfo(skb)->gso_size; bool ipv4 = (skb->protocol == htons(ETH_P_IP)); + bool qos = ieee80211_is_data_qos(hdr->frame_control); u16 ip_base_id = ipv4 ? ntohs(ip_hdr(skb)->id) : 0; skb_shinfo(skb)->gso_size = num_subframes * mss; @@ -864,7 +865,7 @@ iwl_mvm_tx_tso_segment(struct sk_buff *skb, unsigned int num_subframes, if (tcp_payload_len > mss) { skb_shinfo(tmp)->gso_size = mss; } else { - if (ieee80211_is_data_qos(hdr->frame_control)) { + if (qos) { u8 *qc; if (ipv4) |