From: Johannes Berg <johannes.berg@intel.com>
Date: Wed, 14 Sep 2016 07:41:34 +0000 (+0200)
Subject: mac80211: check skb_linearize() return value
X-Git-Tag: v4.7.7~106
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=5c091f61e600b5b2b996b5f7fc8c840fee8db809;p=thirdparty%2Fkernel%2Fstable.git

mac80211: check skb_linearize() return value

commit 0b97a484e52cb423662eb98904aad82dafcc1f10 upstream.

The A-MSDU TX code (within TXQs) didn't always check the return value
of skb_linearize() properly, resulting in potentially passing a frag-
list SKB down to the driver even when it said it can't handle it. Fix
that.

Fixes: 6e0456b545456 ("mac80211: add A-MSDU tx support")
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---

diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 8bad2ad81399e..5f0ed8c6584d2 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -1330,8 +1330,12 @@ out:
 	spin_unlock_bh(&txqi->queue.lock);
 
 	if (skb && skb_has_frag_list(skb) &&
-	    !ieee80211_hw_check(&local->hw, TX_FRAG_LIST))
-		skb_linearize(skb);
+	    !ieee80211_hw_check(&local->hw, TX_FRAG_LIST)) {
+		if (skb_linearize(skb)) {
+			ieee80211_free_txskb(&local->hw, skb);
+			return NULL;
+		}
+	}
 
 	return skb;
 }