mac80211: free skb fraglist before freeing the skb

[ Upstream commit 34b1e0e9efe101822e83cc62d22443ed3867ae7a ]

mac80211 uses the frag list to build AMSDU. When freeing
the skb, it may not be really freed, since someone is still
holding a reference to it.
In that case, when TCP skb is being retransmitted, the
pointer to the frag list is being reused, while the data
in there is no longer valid.
Since we will never get frag list from the network stack,
as mac80211 doesn't advertise the capability, we can safely
free and nullify it before releasing the SKB.

Signed-off-by: Sara Sharon <sara.sharon@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/net/mac80211/status.c b/net/mac80211/status.c
index 35912270087c940e0035a78476d120653199cd68..b18466cf466c50cd0a772c0ffd6426c02d604a2e 100644 (file)
--- a/net/mac80211/status.c
+++ b/net/mac80211/status.c
@@ -545,6 +545,11 @@ static void ieee80211_report_used_skb(struct ieee80211_local *local,
        }
 
        ieee80211_led_tx(local);
+
+       if (skb_has_frag_list(skb)) {
+               kfree_skb_list(skb_shinfo(skb)->frag_list);
+               skb_shinfo(skb)->frag_list = NULL;
+       }
 }
 
 /*