From: Felix Fietkau Date: Mon, 13 Jan 2020 18:21:07 +0000 (+0100) Subject: cfg80211: fix page refcount issue in A-MSDU decap X-Git-Tag: baikal/mips/sdk5.9~14532^2~25^2 X-Git-Url: https://git.baikalelectronics.ru/sdk/?a=commitdiff_plain;h=6cb8fa8082ec4e27664a7db82879e62dc3c5e76d;p=kernel.git cfg80211: fix page refcount issue in A-MSDU decap The fragments attached to a skb can be part of a compound page. In that case, page_ref_inc will increment the refcount for the wrong page. Fix this by using get_page instead, which calls page_ref_inc on the compound head and also checks for overflow. Fixes: bf471a342047 ("cfg80211: reuse existing page fragments in A-MSDU rx") Cc: stable@vger.kernel.org Signed-off-by: Felix Fietkau Link: https://lore.kernel.org/r/20200113182107.20461-1-nbd@nbd.name Signed-off-by: Johannes Berg --- diff --git a/net/wireless/util.c b/net/wireless/util.c index 5b4ed5bbc5425..8481e9ac33da5 100644 --- a/net/wireless/util.c +++ b/net/wireless/util.c @@ -564,7 +564,7 @@ __frame_add_frag(struct sk_buff *skb, struct page *page, struct skb_shared_info *sh = skb_shinfo(skb); int page_offset; - page_ref_inc(page); + get_page(page); page_offset = ptr - page_address(page); skb_add_rx_frag(skb, sh->nr_frags, page, page_offset, len, size); }