]>
Commit | Line | Data |
---|---|---|
6dfab952 GKH |
1 | From 0b97a484e52cb423662eb98904aad82dafcc1f10 Mon Sep 17 00:00:00 2001 |
2 | From: Johannes Berg <johannes.berg@intel.com> | |
3 | Date: Wed, 14 Sep 2016 09:41:34 +0200 | |
4 | Subject: mac80211: check skb_linearize() return value | |
5 | ||
6 | From: Johannes Berg <johannes.berg@intel.com> | |
7 | ||
8 | commit 0b97a484e52cb423662eb98904aad82dafcc1f10 upstream. | |
9 | ||
10 | The A-MSDU TX code (within TXQs) didn't always check the return value | |
11 | of skb_linearize() properly, resulting in potentially passing a frag- | |
12 | list SKB down to the driver even when it said it can't handle it. Fix | |
13 | that. | |
14 | ||
15 | Fixes: 6e0456b545456 ("mac80211: add A-MSDU tx support") | |
16 | Signed-off-by: Johannes Berg <johannes.berg@intel.com> | |
17 | Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | |
18 | ||
19 | --- | |
20 | net/mac80211/tx.c | 8 ++++++-- | |
21 | 1 file changed, 6 insertions(+), 2 deletions(-) | |
22 | ||
23 | --- a/net/mac80211/tx.c | |
24 | +++ b/net/mac80211/tx.c | |
25 | @@ -1330,8 +1330,12 @@ out: | |
26 | spin_unlock_bh(&txqi->queue.lock); | |
27 | ||
28 | if (skb && skb_has_frag_list(skb) && | |
29 | - !ieee80211_hw_check(&local->hw, TX_FRAG_LIST)) | |
30 | - skb_linearize(skb); | |
31 | + !ieee80211_hw_check(&local->hw, TX_FRAG_LIST)) { | |
32 | + if (skb_linearize(skb)) { | |
33 | + ieee80211_free_txskb(&local->hw, skb); | |
34 | + return NULL; | |
35 | + } | |
36 | + } | |
37 | ||
38 | return skb; | |
39 | } |