Patch "mac80211: initialize fast-xmit 'info' later" has been added to the 4.9-stable tree

This is a note to let you know that I've just added the patch titled

mac80211: initialize fast-xmit 'info' later

to the 4.9-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
mac80211-initialize-fast-xmit-info-later.patch
and it can be found in the queue-4.9 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Johannes Berg <[email protected]>
Date: Mon, 2 Jan 2017 11:19:29 +0100
Subject: mac80211: initialize fast-xmit 'info' later

From: Johannes Berg <[email protected]>

commit 35f432a03e41d3bf08c51ede917f94e2288fbe8c upstream.

In ieee80211_xmit_fast(), 'info' is initialized to point to the skb that's passed in, but that skb may later be replaced by a clone (if it was shared), leading to an invalid pointer.

This can lead to use-after-free and also later crashes since the real SKB's info->hw_queue doesn't get initialized properly.

Fix this by assigning info only later, when it's needed, after the skb replacement (may have) happened.

---
 net/mac80211/tx.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

@@ -3262,7 +3262,7 @@ static bool ieee80211_xmit_fast(struct i
 	int extra_head = fast_tx->hdr_len - (ETH_HLEN - 2);
 	int hw_headroom = sdata->local->hw.extra_tx_headroom;
 	struct ethhdr eth;
-	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+	struct ieee80211_tx_info *info;
 	struct ieee80211_hdr *hdr = (void *)fast_tx->hdr;
 	struct ieee80211_tx_data tx;
 	ieee80211_tx_result r;

@@ -3326,6 +3326,7 @@ static bool ieee80211_xmit_fast(struct i
 	memcpy(skb->data + fast_tx->da_offs, eth.h_dest, ETH_ALEN);
 	memcpy(skb->data + fast_tx->sa_offs, eth.h_source, ETH_ALEN);
 
+	info = IEEE80211_SKB_CB(skb);
 	memset(info, 0, sizeof(*info));
 	info->band = fast_tx->band;
 	info->control.vif = &sdata->vif;

Patches currently in stable-queue which might be from [email protected] are

queue-4.9/mac80211-initialize-fast-xmit-info-later.patch