From patchwork Tue Dec 21 20:44:05 2010 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jussi Kivilinna X-Patchwork-Id: 425001 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by demeter1.kernel.org (8.14.4/8.14.3) with ESMTP id oBLKiBdn006943 for ; Tue, 21 Dec 2010 20:44:12 GMT Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752538Ab0LUUoK (ORCPT ); Tue, 21 Dec 2010 15:44:10 -0500 Received: from sypressi.dnainternet.net ([83.102.40.135]:59415 "EHLO sypressi.dnainternet.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751799Ab0LUUoJ (ORCPT ); Tue, 21 Dec 2010 15:44:09 -0500 Received: from localhost (localhost [127.0.0.1]) by sypressi.dnainternet.net (Postfix) with ESMTP id F1835C693E; Tue, 21 Dec 2010 22:44:07 +0200 (EET) X-Virus-Scanned: DNA Postiturva at dnainternet.net X-Spam-Flag: NO X-Spam-Score: -1.44 X-Spam-Level: X-Spam-Status: No, score=-1.44 tagged_above=-9999 required=6 tests=[ALL_TRUSTED=-1.44] Received: from sypressi.dnainternet.net ([83.102.40.135]) by localhost (sypressi.dnainternet.net [127.0.0.1]) (amavisd-new, port 10041) with ESMTP id 9prlyuUSUtsG; Tue, 21 Dec 2010 22:44:07 +0200 (EET) Received: from kirsikkapuu.dnainternet.net (kirsikkapuu.dnainternet.net [83.102.40.214]) by sypressi.dnainternet.net (Postfix) with ESMTP id B9793C635E; Tue, 21 Dec 2010 22:44:07 +0200 (EET) Received: from fate.lan (dyn2-85-23-163-52.psoas.suomi.net [85.23.163.52]) by kirsikkapuu.dnainternet.net (Postfix) with ESMTP id 8B2F07F11E; Tue, 21 Dec 2010 22:44:05 +0200 (EET) Subject: [PATCH 1/7] [v2] rndis_wlan: scanning, workaround device returning incorrect bssid-list item count. To: "John W. Linville" From: Jussi Kivilinna Cc: linux-wireless@vger.kernel.org Date: Tue, 21 Dec 2010 22:44:05 +0200 Message-ID: <20101221204405.12250.35410.stgit@fate.lan> User-Agent: StGit/0.15 MIME-Version: 1.0 Sender: linux-wireless-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-wireless@vger.kernel.org X-Greylist: IP, sender and recipient auto-whitelisted, not delayed by milter-greylist-4.2.3 (demeter1.kernel.org [140.211.167.41]); Tue, 21 Dec 2010 20:44:12 +0000 (UTC) diff --git a/drivers/net/wireless/rndis_wlan.c b/drivers/net/wireless/rndis_wlan.c index 4a4f005..de4c050 100644 --- a/drivers/net/wireless/rndis_wlan.c +++ b/drivers/net/wireless/rndis_wlan.c @@ -1967,8 +1967,8 @@ static struct cfg80211_bss *rndis_bss_info_update(struct usbnet *usbdev, int ie_len, bssid_len; u8 *ie; - netdev_dbg(usbdev->net, " found bssid: '%.32s' [%pM]\n", - bssid->ssid.essid, bssid->mac); + netdev_dbg(usbdev->net, " found bssid: '%.32s' [%pM], len: %d\n", + bssid->ssid.essid, bssid->mac, le32_to_cpu(bssid->length)); /* parse bssid structure */ bssid_len = le32_to_cpu(bssid->length); @@ -2002,54 +2002,98 @@ static struct cfg80211_bss *rndis_bss_info_update(struct usbnet *usbdev, GFP_KERNEL); } +static struct ndis_80211_bssid_ex *next_bssid_list_item( + struct ndis_80211_bssid_ex *bssid, + int *bssid_len, void *buf, int len) +{ + void *buf_end, *bssid_end; + + buf_end = (char *)buf + len; + bssid_end = (char *)bssid + *bssid_len; + + if ((int)(buf_end - bssid_end) < sizeof(bssid->length)) { + *bssid_len = 0; + return NULL; + } else { + bssid = (void *)((char *)bssid + *bssid_len); + *bssid_len = le32_to_cpu(bssid->length); + return bssid; + } +} + +static bool check_bssid_list_item(struct ndis_80211_bssid_ex *bssid, + int bssid_len, void *buf, int len) +{ + void *buf_end, *bssid_end; + + if (!bssid || bssid_len <= 0 || bssid_len > len) + return false; + + buf_end = (char *)buf + len; + bssid_end = (char *)bssid + bssid_len; + + return (int)(buf_end - bssid_end) >= 0 && (int)(bssid_end - buf) >= 0; +} + static int rndis_check_bssid_list(struct usbnet *usbdev, u8 *match_bssid, bool *matched) { void *buf = NULL; struct ndis_80211_bssid_list_ex *bssid_list; struct ndis_80211_bssid_ex *bssid; - int ret = -EINVAL, len, count, bssid_len; - bool resized = false; + int ret = -EINVAL, len, count, bssid_len, real_count, new_len; - netdev_dbg(usbdev->net, "check_bssid_list\n"); + netdev_dbg(usbdev->net, "%s()\n", __func__); len = CONTROL_BUFFER_SIZE; resize_buf: - buf = kmalloc(len, GFP_KERNEL); + buf = kzalloc(len, GFP_KERNEL); if (!buf) { ret = -ENOMEM; goto out; } - ret = rndis_query_oid(usbdev, OID_802_11_BSSID_LIST, buf, &len); - if (ret != 0) + /* BSSID-list might have got bigger last time we checked, keep + * resizing until it won't get any bigger. + */ + new_len = len; + ret = rndis_query_oid(usbdev, OID_802_11_BSSID_LIST, buf, &new_len); + if (ret != 0 || new_len < sizeof(struct ndis_80211_bssid_list_ex)) goto out; - if (!resized && len > CONTROL_BUFFER_SIZE) { - resized = true; + if (new_len > len) { + len = new_len; kfree(buf); goto resize_buf; } + len = new_len; + bssid_list = buf; - bssid = bssid_list->bssid; - bssid_len = le32_to_cpu(bssid->length); count = le32_to_cpu(bssid_list->num_items); - netdev_dbg(usbdev->net, "check_bssid_list: %d BSSIDs found (buflen: %d)\n", - count, len); + real_count = 0; + netdev_dbg(usbdev->net, "%s(): buflen: %d\n", __func__, len); + + bssid_len = 0; + bssid = next_bssid_list_item(bssid_list->bssid, &bssid_len, buf, len); - while (count && ((void *)bssid + bssid_len) <= (buf + len)) { + /* Device returns incorrect 'num_items'. Workaround by ignoring the + * received 'num_items' and walking through full bssid buffer instead. + */ + while (check_bssid_list_item(bssid, bssid_len, buf, len)) { if (rndis_bss_info_update(usbdev, bssid) && match_bssid && matched) { if (compare_ether_addr(bssid->mac, match_bssid)) *matched = true; } - bssid = (void *)bssid + bssid_len; - bssid_len = le32_to_cpu(bssid->length); - count--; + real_count++; + bssid = next_bssid_list_item(bssid, &bssid_len, buf, len); } + netdev_dbg(usbdev->net, "%s(): num_items from device: %d, really found:" + " %d\n", __func__, count, real_count); + out: kfree(buf); return ret;