| Message ID | 20191021005658.31391-1-Larry.Finger@lwfinger.net (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | b43f4a169f220e459edf3ea8f8cd3ec4ae7fa82d |
| Delegated to: | Kalle Valo |
| Headers | show |
| Series | [V3] rtlwifi: rtl_pci: Fix problem of too small skb->len | expand |
Larry Finger <Larry.Finger@lwfinger.net> writes: > In commit 8020919a9b99 ("mac80211: Properly handle SKB with radiotap > only"), buffers whose length is too short cause a WARN_ON(1) to be > executed. This change exposed a fault in rtlwifi drivers, which is fixed > by regarding packets with skb->len <= FCS_LEN as though they are in error > and dropping them. The test is now annotated as likely. > > Cc: Stable <stable@vger.kernel.org> # v5.0+ > Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net> > --- > V2 - content dropped > V3 - changed fix to drop packet rather than arbitrarily increasing the length. Much better, thanks. > Material for 5.4. Ok, I'll queue it for v5.4.
Larry Finger <Larry.Finger@lwfinger.net> wrote: > In commit 8020919a9b99 ("mac80211: Properly handle SKB with radiotap > only"), buffers whose length is too short cause a WARN_ON(1) to be > executed. This change exposed a fault in rtlwifi drivers, which is fixed > by regarding packets with skb->len <= FCS_LEN as though they are in error > and dropping them. The test is now annotated as likely. > > Cc: Stable <stable@vger.kernel.org> # v5.0+ > Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net> Patch applied to wireless-drivers.git, thanks. b43f4a169f22 rtlwifi: rtl_pci: Fix problem of too small skb->len
diff --git a/drivers/net/wireless/realtek/rtlwifi/pci.c b/drivers/net/wireless/realtek/rtlwifi/pci.c index 6087ec7a90a6..f88d26535978 100644 --- a/drivers/net/wireless/realtek/rtlwifi/pci.c +++ b/drivers/net/wireless/realtek/rtlwifi/pci.c @@ -822,7 +822,7 @@ static void _rtl_pci_rx_interrupt(struct ieee80211_hw *hw) hdr = rtl_get_hdr(skb); fc = rtl_get_fc(skb); - if (!stats.crc && !stats.hwerror) { + if (!stats.crc && !stats.hwerror && (skb->len > FCS_LEN)) { memcpy(IEEE80211_SKB_RXCB(skb), &rx_status, sizeof(rx_status)); @@ -859,6 +859,7 @@ static void _rtl_pci_rx_interrupt(struct ieee80211_hw *hw) _rtl_pci_rx_to_mac80211(hw, skb, rx_status); } } else { + /* drop packets with errors or those too short */ dev_kfree_skb_any(skb); } new_trx_end:
In commit 8020919a9b99 ("mac80211: Properly handle SKB with radiotap only"), buffers whose length is too short cause a WARN_ON(1) to be executed. This change exposed a fault in rtlwifi drivers, which is fixed by regarding packets with skb->len <= FCS_LEN as though they are in error and dropping them. The test is now annotated as likely. Cc: Stable <stable@vger.kernel.org> # v5.0+ Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net> --- V2 - content dropped V3 - changed fix to drop packet rather than arbitrarily increasing the length. --- Material for 5.4. --- drivers/net/wireless/realtek/rtlwifi/pci.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)