tree 133beb5662879cd3855ef64c4046969dc4ce1912
parent 5680bf8175a0d8d38a1f1aa6d26e47e74c17bc72
author Johannes Berg <johannes.berg@intel.com> 1415019466 +0100
committer chrmhoffmann <chrmhoffmann@gmail.com> 1586074857 +0200

mac80211: fix use-after-free in defragmentation

commit b8fff407a180286aa683d543d878d98d9fc57b13 upstream.

Upon receiving the last fragment, all but the first fragment
are freed, but the multicast check for statistics at the end
of the function refers to the current skb (the last fragment)
causing a use-after-free bug.

Since multicast frames cannot be fragmented and we check for
this early in the function, just modify that check to also
do the accounting to fix the issue.

Reported-by: Yosef Khyal <yosefx.khyal@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Zefan Li <lizefan@huawei.com>