mac80211: Resolve sk_refcnt/sk_wmem_alloc issue in wifi ack path
authorAlexander Duyck <alexander.h.duyck@intel.com>
Wed, 10 Sep 2014 22:05:42 +0000 (18:05 -0400)
committerDavid S. Miller <davem@davemloft.net>
Fri, 12 Sep 2014 21:51:25 +0000 (17:51 -0400)
commitbf7fa551e0ce507b82935055f4b4aa229be73eeb
tree88068940307b6369cc1f6a2b346f6a070949f4bd
parentcab41c47d92851de71c74b1a7bdbf0fadf6ae4ba
mac80211: Resolve sk_refcnt/sk_wmem_alloc issue in wifi ack path

There is a possible issue with the use, or lack thereof of sk_refcnt and
sk_wmem_alloc in the wifi ack status functionality.

Specifically if a socket were to request acknowledgements, and the socket
were to have sk_refcnt drop to 0 resulting in it waiting on sk_wmem_alloc
to reach 0 it would be possible to have sock_queue_err_skb orphan the last
buffer, resulting in __sk_free being called on the socket.  After this the
buffer is enqueued on sk_error_queue, however the queue has already been
flushed resulting in at least a memory leak, if not a data corruption.

Signed-off-by: Alexander Duyck <alexander.h.duyck@intel.com>
Acked-by: Johannes Berg <johannes@sipsolutions.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
net/core/skbuff.c
net/mac80211/tx.c