| From 9062d5409a090343d1a0e78feda1846bb6010f0e Mon Sep 17 00:00:00 2001 |
| From: Felix Fietkau <nbd@nbd.name> |
| Date: Mon, 13 Jan 2020 19:21:07 +0100 |
| Subject: [PATCH] cfg80211: fix page refcount issue in A-MSDU decap |
| |
| commit 81c044fc3bdc5b7be967cd3682528ea94b58c06a upstream. |
| |
| The fragments attached to a skb can be part of a compound page. In that case, |
| page_ref_inc will increment the refcount for the wrong page. Fix this by |
| using get_page instead, which calls page_ref_inc on the compound head and |
| also checks for overflow. |
| |
| Fixes: 2b67f944f88c ("cfg80211: reuse existing page fragments in A-MSDU rx") |
| Cc: stable@vger.kernel.org |
| Signed-off-by: Felix Fietkau <nbd@nbd.name> |
| Link: https://lore.kernel.org/r/20200113182107.20461-1-nbd@nbd.name |
| Signed-off-by: Johannes Berg <johannes.berg@intel.com> |
| Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> |
| |
| diff --git a/net/wireless/util.c b/net/wireless/util.c |
| index f68818dbac1a..95fc3bbaa07c 100644 |
| --- a/net/wireless/util.c |
| +++ b/net/wireless/util.c |
| @@ -555,7 +555,7 @@ __frame_add_frag(struct sk_buff *skb, struct page *page, |
| struct skb_shared_info *sh = skb_shinfo(skb); |
| int page_offset; |
| |
| - page_ref_inc(page); |
| + get_page(page); |
| page_offset = ptr - page_address(page); |
| skb_add_rx_frag(skb, sh->nr_frags, page, page_offset, len, size); |
| } |
| -- |
| 2.7.4 |
| |
