Emmanuel Grumbach 71b256f8f7 iwlwifi: mvm: fix a use-after-free bug in iwl_mvm_tx_tso_segment ...

Accessing the hdr of an skb that was consumed already isn't
a good idea.
First ask if the skb is a QoS packet, then keep that data
on stack, and then consume the skb.
This was spotted by KASAN.

Cc: stable@vger.kernel.org
Fixes: 08f7d8b69a ("iwlwifi: mvm: bring back mvm GSO code")
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

2019-07-30 18:34:32 +02:00

..

binding.c

…

coex.c

iwlwifi: mvm: simplify some return conditions

2019-02-04 12:27:18 +02:00

constants.h

iwlwifi: mvm: make the usage of TWT configurable

2019-06-29 10:09:43 +03:00

d3.c

iwlwifi: dbg: debug recording stop and restart command remove

2019-06-29 10:09:44 +03:00

debugfs-vif.c

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

2019-05-02 22:14:21 -04:00

debugfs.c

iwlwifi: mvm: remove multiple debugfs entries

2019-06-29 10:09:37 +03:00

debugfs.h

…

ftm-initiator.c

timekeeping: Use proper clock specifier names in functions

2019-06-22 12:11:27 +02:00

ftm-responder.c

iwlwifi: mvm: support FTM responder

2019-02-14 11:29:43 +02:00

fw-api.h

iwlwifi: mvm: add location APIs

2019-01-29 16:10:31 +02:00

fw.c

iwlwifi: mvm: fix an out-of-bound access

2019-07-30 18:34:32 +02:00

led.c

iwlwifi: mvm: add fall through comments where needed

2019-02-04 12:27:20 +02:00

mac80211.c

iwlwifi: fix locking in delayed GTK setting

2019-07-30 18:34:18 +02:00

mac-ctxt.c

iwlwifi: mvm: remove MAC_FILTER_IN_11AX for AP mode

2019-06-29 10:09:44 +03:00

Makefile

iwlwifi: mvm: support FTM initiator

2019-02-14 11:29:43 +02:00

mvm.h

iwlwifi: mvm: send LQ command always ASYNC

2019-07-30 18:34:20 +02:00

nvm.c

iwlwifi: mvm: fix comparison of u32 variable with less than zero

2019-07-30 18:34:19 +02:00

offloading.c

…

ops.c

iwlwifi: mvm: add a new RSS sync notification for NSSN sync

2019-07-30 18:34:12 +02:00

phy-ctxt.c

iwlwifi: mvm: add fall through comments where needed

2019-02-04 12:27:20 +02:00

power.c

iwlwifi: mvm: add support for 32kHz external clock indication

2019-02-14 11:29:47 +02:00

quota.c

…

rs-fw.c

iwlwifi: remove some unnecessary NULL checks

2019-06-29 10:09:38 +03:00

rs.c

iwlwifi: mvm: fix possible out-of-bounds read when accessing lq_info

2019-07-30 18:34:27 +02:00

rs.h

iwlwifi: mvm: replace RS mutex with a spin_lock

2019-07-30 18:34:24 +02:00

rx.c

timekeeping: Use proper clock specifier names in functions

2019-06-22 12:11:27 +02:00

rxmq.c

iwlwifi: mvm: fix frame drop from the reordering buffer

2019-07-30 18:34:25 +02:00

scan.c

iwlwifi: fw api: support adwell HB default APs number api

2019-06-29 10:09:37 +03:00

sf.c

iwlwifi: mvm: make num_active_macs unsigned

2019-01-25 20:57:21 +02:00

sta.c

iwlwifi: mvm: replace RS mutex with a spin_lock

2019-07-30 18:34:24 +02:00

sta.h

iwlwifi: mvm: replace RS mutex with a spin_lock

2019-07-30 18:34:24 +02:00

tdls.c

iwlwifi: mvm: use correct GP2 register address for 22000 family

2019-04-03 11:20:04 +03:00

testmode.h

…

time-event.c

iwlwifi: mvm: Don't sleep in RX path

2019-04-29 18:42:46 +03:00

time-event.h

…

tt.c

…

tx.c

iwlwifi: mvm: fix a use-after-free bug in iwl_mvm_tx_tso_segment

2019-07-30 18:34:32 +02:00

utils.c

iwlwifi: mvm: send LQ command always ASYNC

2019-07-30 18:34:20 +02:00