From patchwork Mon Aug 20 16:53:55 2012 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Sergei Poselenov X-Patchwork-Id: 1350311 Return-Path: X-Original-To: patchwork-linux-wireless@patchwork.kernel.org Delivered-To: patchwork-process-083081@patchwork1.kernel.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by patchwork1.kernel.org (Postfix) with ESMTP id 7969940B05 for ; Mon, 20 Aug 2012 16:54:20 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1757431Ab2HTQyO (ORCPT ); Mon, 20 Aug 2012 12:54:14 -0400 Received: from ocean.emcraft.com ([213.221.7.182]:42332 "EHLO ocean.emcraft.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1757458Ab2HTQyG (ORCPT ); Mon, 20 Aug 2012 12:54:06 -0400 Received: from pvr.emcraft.com ([172.17.0.212] helo=localhost.localdomain) by ocean.emcraft.com with esmtps (TLSv1:AES128-SHA:128) (Exim 4.76) (envelope-from ) id 1T3VEj-0002Ba-5h; Mon, 20 Aug 2012 20:53:57 +0400 Date: Mon, 20 Aug 2012 20:53:55 +0400 From: Sergei Poselenov To: users@rt2x00.serialmonkey.com Cc: "Luis R. Rodriguez" , linux-wireless@vger.kernel.org Subject: [PATCH] compat-wireless:rt2800usb: Added rx packet length validity check Message-ID: <20120820205355.7ccc0450@emcraft.com> Organization: Emcraft Systems X-Mailer: Claws Mail 3.7.9 (GTK+ 2.22.0; i386-redhat-linux-gnu) Mime-Version: 1.0 Sender: linux-wireless-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-wireless@vger.kernel.org On our system (ARM Cortex-M3 SOC running linux-2.6.33 with compat-wireless-3.4-rc3-1 modules configured for rt2x00) frequent crashes were observed in rt2800usb module because of the invalid length of the received packet (3392, 46920...). This patch adds the sanity check on the packet legth. In case of the bad length, mark the packet as with CRC error. The fix was also tested on the latest compat-wireless-3.5.1-1-snpc.tar.bz2, applies cleanly. Cc: stable@vger.kernel.org Signed-off-by: Sergei Poselenov --- drivers/net/wireless/rt2x00/rt2800usb.c | 10 ++++++++-- 1 files changed, 8 insertions(+), 2 deletions(-) -- To unsubscribe from this list: send the line "unsubscribe linux-wireless" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html diff --git a/usbwifi/compat-wireless-3.4-rc3-1/drivers/net/wireless/rt2x00/rt2800usb.c b/usbwifi/compat-wireless-3.4-rc3-1/drivers/net/wireless/rt2x00/rt2800usb.c index 001735f..6776ec8 100644 --- a/usbwifi/compat-wireless-3.4-rc3-1/drivers/net/wireless/rt2x00/rt2800usb.c +++ b/usbwifi/compat-wireless-3.4-rc3-1/drivers/net/wireless/rt2x00/rt2800usb.c @@ -662,13 +662,18 @@ static void rt2800usb_fill_rxdone(struct queue_entry *entry, rx_pkt_len = rt2x00_get_field32(word, RXINFO_W0_USB_DMA_RX_PKT_LEN); /* - * Remove the RXINFO structure from the sbk. + * Remove the RXINFO structure from the skb. */ skb_pull(entry->skb, RXINFO_DESC_SIZE); /* - * FIXME: we need to check for rx_pkt_len validity + * Check for rx_pkt_len validity, mark as failed. */ + if (rx_pkt_len > entry->skb->len) { + rxdesc->flags |= RX_FLAG_FAILED_FCS_CRC; + goto procrxwi; + } + rxd = (__le32 *)(entry->skb->data + rx_pkt_len); /* @@ -713,6 +718,7 @@ static void rt2800usb_fill_rxdone(struct queue_entry *entry, */ skb_trim(entry->skb, rx_pkt_len); +procrxwi: /* * Process the RXWI structure. */