From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-13.5 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH,MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id BB5C4C43387 for ; Fri, 11 Jan 2019 14:31:59 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 8E5C221848 for ; Fri, 11 Jan 2019 14:31:59 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1547217119; bh=nRa/al4YCjMracuNGFvHzOBna8i00A1GmevtbK8uQy8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=A5+/VLje/AhpvgWa7M8jEHf3c59gvK9IM+IkJV/fF7skdyZZmVjmcNFhrRFTUG4gB N4Dcp5BpadEwbHrU7zQvmMvYW8QGyiuEIpvu7d9WZV4iQOPjjywnrmNo/CLnhwlUYF 3z1fSuuFlRlfvfmHL7c67m1zuxaenYFqLb16TkiE= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2389300AbfAKOb6 (ORCPT ); Fri, 11 Jan 2019 09:31:58 -0500 Received: from mail.kernel.org ([198.145.29.99]:51768 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2389286AbfAKObz (ORCPT ); Fri, 11 Jan 2019 09:31:55 -0500 Received: from localhost (5356596B.cm-6-7b.dynamic.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 1122A2063F; Fri, 11 Jan 2019 14:31:53 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1547217114; bh=nRa/al4YCjMracuNGFvHzOBna8i00A1GmevtbK8uQy8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=bOoOmRSbEHIJIevRr2ao92aAuPk3uzJwPxAUKDmZQR1ZuPYggAwLHBCxsM8/bjFBh 0FJoZMcedKxKuzkZK2PKorow+hb07SkbtKLur+vfhpssefC9JcUmOyHPBMUSQ+O6Dt 94oEQQqQIQ0jRvwVfSK5icyozwI7nFZakymmgSbY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Sara Sharon , Luca Coelho , Johannes Berg , Sasha Levin Subject: [PATCH 4.14 047/105] mac80211: free skb fraglist before freeing the skb Date: Fri, 11 Jan 2019 15:14:18 +0100 Message-Id: <20190111131107.060817785@linuxfoundation.org> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20190111131102.899065735@linuxfoundation.org> References: <20190111131102.899065735@linuxfoundation.org> User-Agent: quilt/0.65 X-stable: review X-Patchwork-Hint: ignore MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 4.14-stable review patch. If anyone has any objections, please let me know. ------------------ [ Upstream commit 34b1e0e9efe101822e83cc62d22443ed3867ae7a ] mac80211 uses the frag list to build AMSDU. When freeing the skb, it may not be really freed, since someone is still holding a reference to it. In that case, when TCP skb is being retransmitted, the pointer to the frag list is being reused, while the data in there is no longer valid. Since we will never get frag list from the network stack, as mac80211 doesn't advertise the capability, we can safely free and nullify it before releasing the SKB. Signed-off-by: Sara Sharon Signed-off-by: Luca Coelho Signed-off-by: Johannes Berg Signed-off-by: Sasha Levin --- net/mac80211/status.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/net/mac80211/status.c b/net/mac80211/status.c index 35912270087c..b18466cf466c 100644 --- a/net/mac80211/status.c +++ b/net/mac80211/status.c @@ -545,6 +545,11 @@ static void ieee80211_report_used_skb(struct ieee80211_local *local, } ieee80211_led_tx(local); + + if (skb_has_frag_list(skb)) { + kfree_skb_list(skb_shinfo(skb)->frag_list); + skb_shinfo(skb)->frag_list = NULL; + } } /* -- 2.19.1