| Message ID | 20200407190043.1686-1-Larry.Finger@lwfinger.net (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | ec4d3e3a054578de34cd0b587ab8a1ac36f629d9 |
| Delegated to: | Kalle Valo |
| Headers | show |
| Series | b43legacy: Fix case where channel status is corrupted | expand |
Larry Finger <Larry.Finger@lwfinger.net> wrote: > This patch fixes commit 75388acd0cd8 ("add mac80211-based driver for > legacy BCM43xx devices") > > In https://bugzilla.kernel.org/show_bug.cgi?id=207093, a defect in > b43legacy is reported. Upon testing, thus problem exists on PPC and > X86 platforms, is present in the oldest kernel tested (3.2), and > has been present in the driver since it was first added to the kernel. > > The problem is a corrupted channel status received from the device. > Both the internal card in a PowerBook G4 and the PCMCIA version > (Broadcom BCM4306 with PCI ID 14e4:4320) have the problem. Only Rev, 2 > (revision 4 of the 802.11 core) of the chip has been tested. No other > devices using b43legacy are available for testing. > > Various sources of the problem were considered. Buffer overrun and > other sources of corruption within the driver were rejected because > the faulty channel status is always the same, not a random value. > It was concluded that the faulty data is coming from the device, probably > due to a firmware bug. As that source is not available, the driver > must take appropriate action to recover. > > At present, the driver reports the error, and them continues to process > the bad packet. This is believed that to be a mistake, and the correct > action is to drop the correpted packet. > > Fixes: 75388acd0cd8 ("add mac80211-based driver for legacy BCM43xx devices") > Cc: Stable <stable@vger.kernel.org> > Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net> > Reported-and-tested by: F. Erhard <erhard_f@mailbox.org> Patch applied to wireless-drivers-next.git, thanks. ec4d3e3a0545 b43legacy: Fix case where channel status is corrupted
diff --git a/drivers/net/wireless/broadcom/b43legacy/xmit.c b/drivers/net/wireless/broadcom/b43legacy/xmit.c index e9b23c2e5bd4..efd63f4ce74f 100644 --- a/drivers/net/wireless/broadcom/b43legacy/xmit.c +++ b/drivers/net/wireless/broadcom/b43legacy/xmit.c @@ -558,6 +558,7 @@ void b43legacy_rx(struct b43legacy_wldev *dev, default: b43legacywarn(dev->wl, "Unexpected value for chanstat (0x%X)\n", chanstat); + goto drop; } memcpy(IEEE80211_SKB_RXCB(skb), &status, sizeof(status));
This patch fixes commit 75388acd0cd8 ("add mac80211-based driver for legacy BCM43xx devices") In https://bugzilla.kernel.org/show_bug.cgi?id=207093, a defect in b43legacy is reported. Upon testing, thus problem exists on PPC and X86 platforms, is present in the oldest kernel tested (3.2), and has been present in the driver since it was first added to the kernel. The problem is a corrupted channel status received from the device. Both the internal card in a PowerBook G4 and the PCMCIA version (Broadcom BCM4306 with PCI ID 14e4:4320) have the problem. Only Rev, 2 (revision 4 of the 802.11 core) of the chip has been tested. No other devices using b43legacy are available for testing. Various sources of the problem were considered. Buffer overrun and other sources of corruption within the driver were rejected because the faulty channel status is always the same, not a random value. It was concluded that the faulty data is coming from the device, probably due to a firmware bug. As that source is not available, the driver must take appropriate action to recover. At present, the driver reports the error, and them continues to process the bad packet. This is believed that to be a mistake, and the correct action is to drop the correpted packet. Fixes: 75388acd0cd8 ("add mac80211-based driver for legacy BCM43xx devices") Cc: Stable <stable@vger.kernel.org> Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net> Reported-and-tested by: F. Erhard <erhard_f@mailbox.org> --- Kali This bug has been present since 2007 with no complaints. In addition, the user with a problem already has the fix. I see no rush with this one. Larry --- drivers/net/wireless/broadcom/b43legacy/xmit.c | 1 + 1 file changed, 1 insertion(+)