4.9-stable patches

added patches:
	cfg80211-fix-page-refcount-issue-in-a-msdu-decap.patch

diff --git a/queue-4.9/cfg80211-fix-page-refcount-issue-in-a-msdu-decap.patch b/queue-4.9/cfg80211-fix-page-refcount-issue-in-a-msdu-decap.patch
new file mode 100644 (file)
index 0000000..0592587
--- /dev/null
+++ b/queue-4.9/cfg80211-fix-page-refcount-issue-in-a-msdu-decap.patch
@@ -0,0 +1,36 @@
+From 81c044fc3bdc5b7be967cd3682528ea94b58c06a Mon Sep 17 00:00:00 2001
+From: Felix Fietkau <nbd@nbd.name>
+Date: Mon, 13 Jan 2020 19:21:07 +0100
+Subject: cfg80211: fix page refcount issue in A-MSDU decap
+
+From: Felix Fietkau <nbd@nbd.name>
+
+commit 81c044fc3bdc5b7be967cd3682528ea94b58c06a upstream.
+
+The fragments attached to a skb can be part of a compound page. In that case,
+page_ref_inc will increment the refcount for the wrong page. Fix this by
+using get_page instead, which calls page_ref_inc on the compound head and
+also checks for overflow.
+
+Fixes: 2b67f944f88c ("cfg80211: reuse existing page fragments in A-MSDU rx")
+Cc: stable@vger.kernel.org
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Link: https://lore.kernel.org/r/20200113182107.20461-1-nbd@nbd.name
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/wireless/util.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/wireless/util.c
++++ b/net/wireless/util.c
+@@ -653,7 +653,7 @@ __frame_add_frag(struct sk_buff *skb, st
+       struct skb_shared_info *sh = skb_shinfo(skb);
+       int page_offset;
+ 
+-      page_ref_inc(page);
++      get_page(page);
+       page_offset = ptr - page_address(page);
+       skb_add_rx_frag(skb, sh->nr_frags, page, page_offset, len, size);
+ }

diff --git a/queue-4.9/series b/queue-4.9/series
index d2b53749d7a22aefd8d3e73a0fdb557d2e384098..d238781bc56539754c5ff35e53305c859cc7342c 100644 (file)
--- a/queue-4.9/series
+++ b/queue-4.9/series
@@ -74,3 +74,4 @@ usb-serial-keyspan-handle-unbound-ports.patch
 scsi-fnic-use-kernel-s-pm-format-option-to-print-mac.patch
 scsi-fnic-fix-invalid-stack-access.patch
 arm64-dts-agilex-stratix10-fix-pmu-interrupt-numbers.patch
+cfg80211-fix-page-refcount-issue-in-a-msdu-decap.patch