projects / platform / kernel / linux-rpi.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: ba3224d) | patch
iwlwifi: mvm: fix a use-after-free bug in iwl_mvm_tx_tso_segment
authorEmmanuel Grumbach <emmanuel.grumbach@intel.com>
Mon, 22 Jul 2019 10:02:25 +0000 (13:02 +0300)
committerJohannes Berg <johannes.berg@intel.com>
Tue, 30 Jul 2019 16:34:32 +0000 (18:34 +0200)
commit71b256f8f7a5c09810d2c3ed6165629c2cc0a652
treeb6855d953e722017be475e4b121871a9f59223a7tree | snapshot
parentba3224db78034435e9ff0247277cce7c7bb1756ccommit | diff
iwlwifi: mvm: fix a use-after-free bug in iwl_mvm_tx_tso_segment

Accessing the hdr of an skb that was consumed already isn't
a good idea.
First ask if the skb is a QoS packet, then keep that data
on stack, and then consume the skb.
This was spotted by KASAN.

Cc: stable@vger.kernel.org
Fixes: 08f7d8b69aaf ("iwlwifi: mvm: bring back mvm GSO code")
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
drivers/net/wireless/intel/iwlwifi/mvm/tx.c diff | blob | history
Domain: System / Kernel;