]> git.baikalelectronics.ru Git - kernel.git/commit
iwlwifi: mvm: fix a use-after-free bug in iwl_mvm_tx_tso_segment
authorEmmanuel Grumbach <emmanuel.grumbach@intel.com>
Mon, 22 Jul 2019 10:02:25 +0000 (13:02 +0300)
committerJohannes Berg <johannes.berg@intel.com>
Tue, 30 Jul 2019 16:34:32 +0000 (18:34 +0200)
commit2d31dbd6c989b6d1750f3c15cad9d86467e77317
treeb6855d953e722017be475e4b121871a9f59223a7
parent598c30eb6bfc5715fb514c0fb63a0fb7dee37a27
iwlwifi: mvm: fix a use-after-free bug in iwl_mvm_tx_tso_segment

Accessing the hdr of an skb that was consumed already isn't
a good idea.
First ask if the skb is a QoS packet, then keep that data
on stack, and then consume the skb.
This was spotted by KASAN.

Cc: stable@vger.kernel.org
Fixes: 3fe4fff2cead ("iwlwifi: mvm: bring back mvm GSO code")
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
drivers/net/wireless/intel/iwlwifi/mvm/tx.c