From: Greg Kroah-Hartman Date: Mon, 20 Jan 2020 11:18:00 +0000 (+0100) Subject: 4.9-stable patches X-Git-Tag: v4.4.211~35 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=a262b88376e7b9fe237c6b50368ea2ba8a80da38;p=thirdparty%2Fkernel%2Fstable-queue.git 4.9-stable patches added patches: cfg80211-fix-page-refcount-issue-in-a-msdu-decap.patch --- diff --git a/queue-4.9/cfg80211-fix-page-refcount-issue-in-a-msdu-decap.patch b/queue-4.9/cfg80211-fix-page-refcount-issue-in-a-msdu-decap.patch new file mode 100644 index 00000000000..05925876825 --- /dev/null +++ b/queue-4.9/cfg80211-fix-page-refcount-issue-in-a-msdu-decap.patch @@ -0,0 +1,36 @@ +From 81c044fc3bdc5b7be967cd3682528ea94b58c06a Mon Sep 17 00:00:00 2001 +From: Felix Fietkau +Date: Mon, 13 Jan 2020 19:21:07 +0100 +Subject: cfg80211: fix page refcount issue in A-MSDU decap + +From: Felix Fietkau + +commit 81c044fc3bdc5b7be967cd3682528ea94b58c06a upstream. + +The fragments attached to a skb can be part of a compound page. In that case, +page_ref_inc will increment the refcount for the wrong page. Fix this by +using get_page instead, which calls page_ref_inc on the compound head and +also checks for overflow. + +Fixes: 2b67f944f88c ("cfg80211: reuse existing page fragments in A-MSDU rx") +Cc: stable@vger.kernel.org +Signed-off-by: Felix Fietkau +Link: https://lore.kernel.org/r/20200113182107.20461-1-nbd@nbd.name +Signed-off-by: Johannes Berg +Signed-off-by: Greg Kroah-Hartman + +--- + net/wireless/util.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/wireless/util.c ++++ b/net/wireless/util.c +@@ -653,7 +653,7 @@ __frame_add_frag(struct sk_buff *skb, st + struct skb_shared_info *sh = skb_shinfo(skb); + int page_offset; + +- page_ref_inc(page); ++ get_page(page); + page_offset = ptr - page_address(page); + skb_add_rx_frag(skb, sh->nr_frags, page, page_offset, len, size); + } diff --git a/queue-4.9/series b/queue-4.9/series index d2b53749d7a..d238781bc56 100644 --- a/queue-4.9/series +++ b/queue-4.9/series @@ -74,3 +74,4 @@ usb-serial-keyspan-handle-unbound-ports.patch scsi-fnic-use-kernel-s-pm-format-option-to-print-mac.patch scsi-fnic-fix-invalid-stack-access.patch arm64-dts-agilex-stratix10-fix-pmu-interrupt-numbers.patch +cfg80211-fix-page-refcount-issue-in-a-msdu-decap.patch