cfg80211: fix page refcount issue in A-MSDU decap
authorFelix Fietkau <nbd@nbd.name>
Mon, 13 Jan 2020 18:21:07 +0000 (19:21 +0100)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 23 Jan 2020 07:22:47 +0000 (08:22 +0100)
commit98268bf6c96c9e0e2462674ada0859b46791043f
tree15c4c4cd5a186db29f5e4ca4a9cde8b74782c69d
parentb7c9d9df172d12d9c09245adff858d49c8c22625
cfg80211: fix page refcount issue in A-MSDU decap

commit 81c044fc3bdc5b7be967cd3682528ea94b58c06a upstream.

The fragments attached to a skb can be part of a compound page. In that case,
page_ref_inc will increment the refcount for the wrong page. Fix this by
using get_page instead, which calls page_ref_inc on the compound head and
also checks for overflow.

Fixes: 2b67f944f88c ("cfg80211: reuse existing page fragments in A-MSDU rx")
Cc: stable@vger.kernel.org
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Link: https://lore.kernel.org/r/20200113182107.20461-1-nbd@nbd.name
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
net/wireless/util.c