lkml.org 
[lkml]   [2019]   [Aug]   [14]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.2 142/144] iwlwifi: mvm: fix a use-after-free bug in iwl_mvm_tx_tso_segment
    Date
    From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

    commit 71b256f8f7a5c09810d2c3ed6165629c2cc0a652 upstream.

    Accessing the hdr of an skb that was consumed already isn't
    a good idea.
    First ask if the skb is a QoS packet, then keep that data
    on stack, and then consume the skb.
    This was spotted by KASAN.

    Cc: stable@vger.kernel.org
    Fixes: 08f7d8b69aaf ("iwlwifi: mvm: bring back mvm GSO code")
    Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
    Signed-off-by: Johannes Berg <johannes.berg@intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    drivers/net/wireless/intel/iwlwifi/mvm/tx.c | 3 ++-
    1 file changed, 2 insertions(+), 1 deletion(-)

    --- a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
    +++ b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
    @@ -831,6 +831,7 @@ iwl_mvm_tx_tso_segment(struct sk_buff *s
    unsigned int tcp_payload_len;
    unsigned int mss = skb_shinfo(skb)->gso_size;
    bool ipv4 = (skb->protocol == htons(ETH_P_IP));
    + bool qos = ieee80211_is_data_qos(hdr->frame_control);
    u16 ip_base_id = ipv4 ? ntohs(ip_hdr(skb)->id) : 0;

    skb_shinfo(skb)->gso_size = num_subframes * mss;
    @@ -864,7 +865,7 @@ iwl_mvm_tx_tso_segment(struct sk_buff *s
    if (tcp_payload_len > mss) {
    skb_shinfo(tmp)->gso_size = mss;
    } else {
    - if (ieee80211_is_data_qos(hdr->frame_control)) {
    + if (qos) {
    u8 *qc;

    if (ipv4)

    \
     
     \ /
      Last update: 2019-08-14 19:10    [W:2.188 / U:0.072 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site