From: Felix Fietkau <nbd@xxxxxxxx> commit 81c044fc3bdc5b7be967cd3682528ea94b58c06a upstream. The fragments attached to a skb can be part of a compound page. In that case, page_ref_inc will increment the refcount for the wrong page. Fix this by using get_page instead, which calls page_ref_inc on the compound head and also checks for overflow. Fixes: 2b67f944f88c ("cfg80211: reuse existing page fragments in A-MSDU rx") Cc: stable@xxxxxxxxxxxxxxx Signed-off-by: Felix Fietkau <nbd@xxxxxxxx> Link: https://lore.kernel.org/r/20200113182107.20461-1-nbd@xxxxxxxx Signed-off-by: Johannes Berg <johannes.berg@xxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- net/wireless/util.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/net/wireless/util.c +++ b/net/wireless/util.c @@ -653,7 +653,7 @@ __frame_add_frag(struct sk_buff *skb, st struct skb_shared_info *sh = skb_shinfo(skb); int page_offset; - page_ref_inc(page); + get_page(page); page_offset = ptr - page_address(page); skb_add_rx_frag(skb, sh->nr_frags, page, page_offset, len, size); }