mac80211: initialize fast-xmit 'info' later
authorJohannes Berg <johannes.berg@intel.com>
Mon, 2 Jan 2017 10:19:29 +0000 (11:19 +0100)
committerJohannes Berg <johannes.berg@intel.com>
Mon, 2 Jan 2017 10:28:25 +0000 (11:28 +0100)
commit35f432a03e41d3bf08c51ede917f94e2288fbe8c
tree67eed715e449fb7460f834c32edf723f2b4efa05
parenteb7903bb83cc1db31a9124d4cc8a1bddebe26e33
mac80211: initialize fast-xmit 'info' later

In ieee80211_xmit_fast(), 'info' is initialized to point to the skb
that's passed in, but that skb may later be replaced by a clone (if
it was shared), leading to an invalid pointer.

This can lead to use-after-free and also later crashes since the
real SKB's info->hw_queue doesn't get initialized properly.

Fix this by assigning info only later, when it's needed, after the
skb replacement (may have) happened.

Cc: stable@vger.kernel.org
Reported-by: Ben Greear <greearb@candelatech.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
net/mac80211/tx.c