Commit 92cee08d authored by Cole Leavitt's avatar Cole Leavitt Committed by Miri Korenblit
Browse files

wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled 



When the TLC notification disables AMSDU for a TID, the MLD driver sets
max_tid_amsdu_len to the sentinel value 1. The TSO segmentation path in
iwl_mld_tx_tso_segment() checks for zero but not for this sentinel,
allowing it to reach the num_subframes calculation:

  num_subframes = (max_tid_amsdu_len + pad) / (subf_len + pad)
                = (1 + 2) / (1534 + 2) = 0

This zero propagates to iwl_tx_tso_segment() which sets:

  gso_size = num_subframes * mss = 0

Calling skb_gso_segment() with gso_size=0 creates over 32000 tiny
segments from a single GSO skb. This floods the TX ring with ~1024
micro-frames (the rest are purged), creating a massive burst of TX
completion events that can lead to memory corruption and a subsequent
use-after-free in TCP's retransmit queue (refcount underflow in
tcp_shifted_skb, NULL deref in tcp_rack_detect_loss).

The MVM driver is immune because it checks mvmsta->amsdu_enabled before
reaching the num_subframes calculation. The MLD driver has no equivalent
bitmap check and relies solely on max_tid_amsdu_len, which does not
catch the sentinel value.

Fix this by detecting the sentinel value (max_tid_amsdu_len == 1) at the
existing check and falling back to non-AMSDU TSO segmentation. Also add
a WARN_ON_ONCE guard after the num_subframes division as defense-in-depth
to catch any future code paths that produce zero through a different
mechanism.

Suggested-by: default avatarMiriam Rachel Korenblit <miriam.rachel.korenblit@intel.com>
Fixes: d1e879ec ("wifi: iwlwifi: add iwlmld sub-driver")
Signed-off-by: default avatarCole Leavitt <cole@unwrap.rs>
Link: https://patch.msgid.link/20260405054145.1064152-3-cole@unwrap.rs


Signed-off-by: default avatarMiri Korenblit <miriam.rachel.korenblit@intel.com>
parent 7666dbb1

drivers/net/wireless/intel/iwlwifi/mld/tx.c

+4 −1
Original line number Diff line number Diff line
@@ -834,7 +834,7 @@ static int iwl_mld_tx_tso_segment(struct iwl_mld *mld, struct sk_buff *skb, 
		return -EINVAL;



	max_tid_amsdu_len = sta->cur->max_tid_amsdu_len[tid];

	if (!max_tid_amsdu_len)

	if (!max_tid_amsdu_len || max_tid_amsdu_len == 1)

		return iwl_tx_tso_segment(skb, 1, netdev_flags, mpdus_skbs);



	/* Sub frame header + SNAP + IP header + TCP header + MSS */
@@ -846,6 +846,9 @@ static int iwl_mld_tx_tso_segment(struct iwl_mld *mld, struct sk_buff *skb, 
	 */

	num_subframes = (max_tid_amsdu_len + pad) / (subf_len + pad);



	if (WARN_ON_ONCE(!num_subframes))

		return iwl_tx_tso_segment(skb, 1, netdev_flags, mpdus_skbs);



	if (sta->max_amsdu_subframes &&

	    num_subframes > sta->max_amsdu_subframes)

		num_subframes = sta->max_amsdu_subframes;