package/kernel/mac80211/patches/350-mac80211-init-fastxmit-later.patch

   1 From 35f432a03e41d3bf08c51ede917f94e2288fbe8c Mon Sep 17 00:00:00 2001
   2 From: Johannes Berg <johannes.berg@intel.com>
   3 Date: Mon, 2 Jan 2017 11:19:29 +0100
   4 Subject: [PATCH] mac80211: initialize fast-xmit 'info' later
   5
   6 In ieee80211_xmit_fast(), 'info' is initialized to point to the skb
   7 that's passed in, but that skb may later be replaced by a clone (if
   8 it was shared), leading to an invalid pointer.
   9
  10 This can lead to use-after-free and also later crashes since the
  11 real SKB's info->hw_queue doesn't get initialized properly.
  12
  13 Fix this by assigning info only later, when it's needed, after the
  14 skb replacement (may have) happened.
  15
  16 Cc: stable@vger.kernel.org
  17 Reported-by: Ben Greear <greearb@candelatech.com>
  18 Signed-off-by: Johannes Berg <johannes.berg@intel.com>
  19 ---
  20  net/mac80211/tx.c | 3 ++-
  21  1 file changed, 2 insertions(+), 1 deletion(-)
  22
  23 --- a/net/mac80211/tx.c
  24 +++ b/net/mac80211/tx.c
  25 @@ -3297,7 +3297,7 @@ static bool ieee80211_xmit_fast(struct i
  26         int extra_head = fast_tx->hdr_len - (ETH_HLEN - 2);
  27         int hw_headroom = sdata->local->hw.extra_tx_headroom;
  28         struct ethhdr eth;
  29 -       struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
  30 +       struct ieee80211_tx_info *info;
  31         struct ieee80211_hdr *hdr = (void *)fast_tx->hdr;
  32         struct ieee80211_tx_data tx;
  33         ieee80211_tx_result r;
  34 @@ -3361,6 +3361,7 @@ static bool ieee80211_xmit_fast(struct i
  35         memcpy(skb->data + fast_tx->da_offs, eth.h_dest, ETH_ALEN);
  36         memcpy(skb->data + fast_tx->sa_offs, eth.h_source, ETH_ALEN);
  37
  38 +       info = IEEE80211_SKB_CB(skb);
  39         memset(info, 0, sizeof(*info));
  40         info->band = fast_tx->band;
  41         info->control.vif = &sdata->vif;