]> git.baikalelectronics.ru Git - kernel.git/commit
iwlwifi: mvm: fix a use-after-free bug in iwl_mvm_tx_tso_segment
authorEmmanuel Grumbach <emmanuel.grumbach@intel.com>
Mon, 22 Jul 2019 10:02:25 +0000 (13:02 +0300)
committerJohannes Berg <johannes.berg@intel.com>
Tue, 30 Jul 2019 16:34:32 +0000 (18:34 +0200)
commitdba0a216c9ea06d435900a63220b6904d848f5d9
treeb6855d953e722017be475e4b121871a9f59223a7
parent54243f2f70ad5405e84a4bab1e3089fdbf5c34c2
iwlwifi: mvm: fix a use-after-free bug in iwl_mvm_tx_tso_segment

Accessing the hdr of an skb that was consumed already isn't
a good idea.
First ask if the skb is a QoS packet, then keep that data
on stack, and then consume the skb.
This was spotted by KASAN.

Cc: stable@vger.kernel.org
Fixes: 65489680143e ("iwlwifi: mvm: bring back mvm GSO code")
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
drivers/net/wireless/intel/iwlwifi/mvm/tx.c