Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 4a0a3385 authored by Felix Fietkau's avatar Felix Fietkau Committed by Greg Kroah-Hartman
Browse files

cfg80211: fix page refcount issue in A-MSDU decap 



commit 81c044fc3bdc5b7be967cd3682528ea94b58c06a upstream.

The fragments attached to a skb can be part of a compound page. In that case,
page_ref_inc will increment the refcount for the wrong page. Fix this by
using get_page instead, which calls page_ref_inc on the compound head and
also checks for overflow.

Fixes: 2b67f944 ("cfg80211: reuse existing page fragments in A-MSDU rx")
Cc: stable@vger.kernel.org
Signed-off-by: default avatarFelix Fietkau <nbd@nbd.name>
Link: https://lore.kernel.org/r/20200113182107.20461-1-nbd@nbd.name


Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 3407f517

net/wireless/util.c

+1 −1
Original line number Diff line number Diff line
@@ -653,7 +653,7 @@ __frame_add_frag(struct sk_buff *skb, struct page *page, 
	struct skb_shared_info *sh = skb_shinfo(skb);

	int page_offset;



	page_ref_inc(page);

	get_page(page);

	page_offset = ptr - page_address(page);

	skb_add_rx_frag(skb, sh->nr_frags, page, page_offset, len, size);

}