| commit | 71b256f8f7a5c09810d2c3ed6165629c2cc0a652 | [log] [tgz] |
|---|---|---|
| author | Emmanuel Grumbach <emmanuel.grumbach@intel.com> | Mon Jul 22 13:02:25 2019 +0300 |
| committer | Johannes Berg <johannes.berg@intel.com> | Tue Jul 30 18:34:32 2019 +0200 |
| tree | b6855d953e722017be475e4b121871a9f59223a7 | |
| parent | ba3224db78034435e9ff0247277cce7c7bb1756c [diff] |
iwlwifi: mvm: fix a use-after-free bug in iwl_mvm_tx_tso_segment
Accessing the hdr of an skb that was consumed already isn't
a good idea.
First ask if the skb is a QoS packet, then keep that data
on stack, and then consume the skb.
This was spotted by KASAN.
Cc: stable@vger.kernel.org
Fixes: 08f7d8b69aaf ("iwlwifi: mvm: bring back mvm GSO code")
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>