Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 71b256f8 authored by Emmanuel Grumbach's avatar Emmanuel Grumbach Committed by Johannes Berg
Browse files

iwlwifi: mvm: fix a use-after-free bug in iwl_mvm_tx_tso_segment 



Accessing the hdr of an skb that was consumed already isn't
a good idea.
First ask if the skb is a QoS packet, then keep that data
on stack, and then consume the skb.
This was spotted by KASAN.

Cc: stable@vger.kernel.org
Fixes: 08f7d8b6 ("iwlwifi: mvm: bring back mvm GSO code")
Signed-off-by: default avatarEmmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
parent ba3224db

drivers/net/wireless/intel/iwlwifi/mvm/tx.c

+2 −1
Original line number Diff line number Diff line
@@ -831,6 +831,7 @@ iwl_mvm_tx_tso_segment(struct sk_buff *skb, unsigned int num_subframes, 
	unsigned int tcp_payload_len;

	unsigned int mss = skb_shinfo(skb)->gso_size;

	bool ipv4 = (skb->protocol == htons(ETH_P_IP));

	bool qos = ieee80211_is_data_qos(hdr->frame_control);

	u16 ip_base_id = ipv4 ? ntohs(ip_hdr(skb)->id) : 0;



	skb_shinfo(skb)->gso_size = num_subframes * mss;
@@ -864,7 +865,7 @@ iwl_mvm_tx_tso_segment(struct sk_buff *skb, unsigned int num_subframes, 
		if (tcp_payload_len > mss) {

			skb_shinfo(tmp)->gso_size = mss;

		} else {

			if (ieee80211_is_data_qos(hdr->frame_control)) {

			if (qos) {

				u8 *qc;



				if (ipv4)