summaryrefslogtreecommitdiff
path: root/net/wireless
diff options
context:
space:
mode:
authorFelix Fietkau <nbd@nbd.name>2020-01-13 21:21:07 +0300
committerJohannes Berg <johannes.berg@intel.com>2020-01-15 11:53:35 +0300
commit81c044fc3bdc5b7be967cd3682528ea94b58c06a (patch)
treef09acc26054ddbfb3e7410769fc5ea2544adb60a /net/wireless
parent24953de0a5e31dcca7e82c8a3c79abc2dfe8fb6e (diff)
downloadlinux-81c044fc3bdc5b7be967cd3682528ea94b58c06a.tar.xz
cfg80211: fix page refcount issue in A-MSDU decap
The fragments attached to a skb can be part of a compound page. In that case, page_ref_inc will increment the refcount for the wrong page. Fix this by using get_page instead, which calls page_ref_inc on the compound head and also checks for overflow. Fixes: 2b67f944f88c ("cfg80211: reuse existing page fragments in A-MSDU rx") Cc: stable@vger.kernel.org Signed-off-by: Felix Fietkau <nbd@nbd.name> Link: https://lore.kernel.org/r/20200113182107.20461-1-nbd@nbd.name Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Diffstat (limited to 'net/wireless')
-rw-r--r--net/wireless/util.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/net/wireless/util.c b/net/wireless/util.c
index 5b4ed5bbc542..8481e9ac33da 100644
--- a/net/wireless/util.c
+++ b/net/wireless/util.c
@@ -564,7 +564,7 @@ __frame_add_frag(struct sk_buff *skb, struct page *page,
struct skb_shared_info *sh = skb_shinfo(skb);
int page_offset;
- page_ref_inc(page);
+ get_page(page);
page_offset = ptr - page_address(page);
skb_add_rx_frag(skb, sh->nr_frags, page, page_offset, len, size);
}