aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorSara Sharon <sara.sharon@intel.com>2018-12-15 11:03:06 +0200
committerJohannes Berg <johannes.berg@intel.com>2018-12-19 09:40:17 +0100
commit34b1e0e9efe101822e83cc62d22443ed3867ae7a (patch)
treee8427e1dad5a69fd38dfb029efbae16d88849820
parentnl80211: fix memory leak if validate_pae_over_nl80211() fails (diff)
downloadlinux-dev-34b1e0e9efe101822e83cc62d22443ed3867ae7a.tar.xz
linux-dev-34b1e0e9efe101822e83cc62d22443ed3867ae7a.zip
mac80211: free skb fraglist before freeing the skb
mac80211 uses the frag list to build AMSDU. When freeing the skb, it may not be really freed, since someone is still holding a reference to it. In that case, when TCP skb is being retransmitted, the pointer to the frag list is being reused, while the data in there is no longer valid. Since we will never get frag list from the network stack, as mac80211 doesn't advertise the capability, we can safely free and nullify it before releasing the SKB. Signed-off-by: Sara Sharon <sara.sharon@intel.com> Signed-off-by: Luca Coelho <luciano.coelho@intel.com> Signed-off-by: Johannes Berg <johannes.berg@intel.com>
-rw-r--r--net/mac80211/status.c5
1 files changed, 5 insertions, 0 deletions
diff --git a/net/mac80211/status.c b/net/mac80211/status.c
index a794ca729000..3f0b96e1e02f 100644
--- a/net/mac80211/status.c
+++ b/net/mac80211/status.c
@@ -556,6 +556,11 @@ static void ieee80211_report_used_skb(struct ieee80211_local *local,
}
ieee80211_led_tx(local);
+
+ if (skb_has_frag_list(skb)) {
+ kfree_skb_list(skb_shinfo(skb)->frag_list);
+ skb_shinfo(skb)->frag_list = NULL;
+ }
}
/*