adf2fef5e8
Backports the following upstream fixes: mac80211: initialize fast-xmit 'info' later mac80211: fix legacy and invalid rx-rate report mac80211: fix tid_agg_rx NULL dereference Compiled and tested on: cns3xxx Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>
41 lines
1.6 KiB
Diff
41 lines
1.6 KiB
Diff
From 35f432a03e41d3bf08c51ede917f94e2288fbe8c Mon Sep 17 00:00:00 2001
|
|
From: Johannes Berg <johannes.berg@intel.com>
|
|
Date: Mon, 2 Jan 2017 11:19:29 +0100
|
|
Subject: [PATCH] mac80211: initialize fast-xmit 'info' later
|
|
|
|
In ieee80211_xmit_fast(), 'info' is initialized to point to the skb
|
|
that's passed in, but that skb may later be replaced by a clone (if
|
|
it was shared), leading to an invalid pointer.
|
|
|
|
This can lead to use-after-free and also later crashes since the
|
|
real SKB's info->hw_queue doesn't get initialized properly.
|
|
|
|
Fix this by assigning info only later, when it's needed, after the
|
|
skb replacement (may have) happened.
|
|
|
|
Cc: stable@vger.kernel.org
|
|
Reported-by: Ben Greear <greearb@candelatech.com>
|
|
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
|
|
---
|
|
net/mac80211/tx.c | 3 ++-
|
|
1 file changed, 2 insertions(+), 1 deletion(-)
|
|
|
|
--- a/net/mac80211/tx.c
|
|
+++ b/net/mac80211/tx.c
|
|
@@ -3297,7 +3297,7 @@ static bool ieee80211_xmit_fast(struct i
|
|
int extra_head = fast_tx->hdr_len - (ETH_HLEN - 2);
|
|
int hw_headroom = sdata->local->hw.extra_tx_headroom;
|
|
struct ethhdr eth;
|
|
- struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
|
|
+ struct ieee80211_tx_info *info;
|
|
struct ieee80211_hdr *hdr = (void *)fast_tx->hdr;
|
|
struct ieee80211_tx_data tx;
|
|
ieee80211_tx_result r;
|
|
@@ -3361,6 +3361,7 @@ static bool ieee80211_xmit_fast(struct i
|
|
memcpy(skb->data + fast_tx->da_offs, eth.h_dest, ETH_ALEN);
|
|
memcpy(skb->data + fast_tx->sa_offs, eth.h_source, ETH_ALEN);
|
|
|
|
+ info = IEEE80211_SKB_CB(skb);
|
|
memset(info, 0, sizeof(*info));
|
|
info->band = fast_tx->band;
|
|
info->control.vif = &sdata->vif;
|