From patchwork Wed Jan 2 14:22:46 2013 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Arend van Spriel X-Patchwork-Id: 1923911 Return-Path: X-Original-To: patchwork-linux-wireless@patchwork.kernel.org Delivered-To: patchwork-process-083081@patchwork2.kernel.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by patchwork2.kernel.org (Postfix) with ESMTP id AA5EBDF230 for ; Wed, 2 Jan 2013 14:23:41 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752786Ab3ABOXN (ORCPT ); Wed, 2 Jan 2013 09:23:13 -0500 Received: from mms3.broadcom.com ([216.31.210.19]:3939 "EHLO mms3.broadcom.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752782Ab3ABOXI (ORCPT ); Wed, 2 Jan 2013 09:23:08 -0500 Received: from [10.9.200.133] by mms3.broadcom.com with ESMTP (Broadcom SMTP Relay (Email Firewall v6.5)); Wed, 02 Jan 2013 06:18:01 -0800 X-Server-Uuid: B86B6450-0931-4310-942E-F00ED04CA7AF Received: from mail-irva-13.broadcom.com (10.11.16.103) by IRVEXCHHUB02.corp.ad.broadcom.com (10.9.200.133) with Microsoft SMTP Server id 8.2.247.2; Wed, 2 Jan 2013 06:22:45 -0800 Received: from mail-sj1-12.sj.broadcom.com (mail-sj1-12.sj.broadcom.com [10.17.16.106]) by mail-irva-13.broadcom.com (Postfix) with ESMTP id 3744940FE4; Wed, 2 Jan 2013 06:22:58 -0800 (PST) Received: from linux-e6410-1 (unknown [10.176.68.32]) by mail-sj1-12.sj.broadcom.com (Postfix) with ESMTP id 081AA207DE; Wed, 2 Jan 2013 06:22:55 -0800 (PST) Received: from arend by linux-e6410-1 with local (Exim 4.80) ( envelope-from ) id 1TqPDb-0004md-21; Wed, 02 Jan 2013 15:22:55 +0100 From: "Arend van Spriel" To: "John W. Linville" cc: "Linux Wireless List" , "Arend van Spriel" Subject: [PATCH 13/18] brcmfmac: cleanup netdev transmit callback Date: Wed, 2 Jan 2013 15:22:46 +0100 Message-ID: <1357136572-18273-14-git-send-email-arend@broadcom.com> X-Mailer: git-send-email 1.7.10.4 In-Reply-To: <1357136572-18273-1-git-send-email-arend@broadcom.com> References: <1357136572-18273-1-git-send-email-arend@broadcom.com> MIME-Version: 1.0 X-WSS-ID: 7CFA9E1339W21354697-01-01 Sender: linux-wireless-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-wireless@vger.kernel.org The header of the ethernet packet is processed conditionally, but the check is wrong as it checks skb length is at least ETH_ALEN. It should check it is at least sizeof struct ethhdr instead. Reviewed-by: Pieter-Paul Giesberts Reviewed-by: Hante Meuleman Signed-off-by: Arend van Spriel --- .../net/wireless/brcm80211/brcmfmac/dhd_linux.c | 22 ++++++++++++-------- 1 file changed, 13 insertions(+), 9 deletions(-) diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c b/drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c index a1ca691..9ca7411 100644 --- a/drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c +++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c @@ -165,6 +165,7 @@ static int brcmf_netdev_start_xmit(struct sk_buff *skb, struct net_device *ndev) int ret; struct brcmf_if *ifp = netdev_priv(ndev); struct brcmf_pub *drvr = ifp->drvr; + struct ethhdr *eh; brcmf_dbg(TRACE, "Enter\n"); @@ -202,17 +203,20 @@ static int brcmf_netdev_start_xmit(struct sk_buff *skb, struct net_device *ndev) } } - /* Update multicast statistic */ - if (skb->len >= ETH_ALEN) { - u8 *pktdata = (u8 *)(skb->data); - struct ethhdr *eh = (struct ethhdr *)pktdata; - - if (is_multicast_ether_addr(eh->h_dest)) - drvr->tx_multicast++; - if (ntohs(eh->h_proto) == ETH_P_PAE) - atomic_inc(&drvr->pend_8021x_cnt); + /* validate length for ether packet */ + if (skb->len < sizeof(*eh)) { + ret = -EINVAL; + dev_kfree_skb(skb); + goto done; } + /* handle ethernet header */ + eh = (struct ethhdr *)(skb->data); + if (is_multicast_ether_addr(eh->h_dest)) + drvr->tx_multicast++; + if (ntohs(eh->h_proto) == ETH_P_PAE) + atomic_inc(&drvr->pend_8021x_cnt); + /* If the protocol uses a data header, apply it */ brcmf_proto_hdrpush(drvr, ifp->idx, skb);