| Message ID | 555AC172.4040507@lwfinger.net (mailing list archive) |
|---|---|
| State | Not Applicable |
| Delegated to: | Kalle Valo |
| Headers | show |
On 19 May 2015 at 07:52, Larry Finger <Larry.Finger@lwfinger.net> wrote: > OK, I will have to search further upstream to see how a faulty skb was > provided. > > I have been testing r8712u on my x86_64 system with no difficulty. > > I checked the driver with Smatch and found a couple of array problems. These > likely won't be the problem, but try the attached patches anyway. I found one place that might be the cause for the fault. The recvbuf2recvframe function has a line copying memory between the incoming pskb and a new allocated skb: 1065 pkt_copy = netdev_alloc_skb(padapter->pnetdev, alloc_sz); 1066 if (pkt_copy) { 1067 precvframe->u.hdr.pkt = pkt_copy; 1068 skb_reserve(pkt_copy, 4 - ((addr_t)(pkt_copy->data) 1069 % 4)); 1070 skb_reserve(pkt_copy, shift_sz); 1071 memcpy(pkt_copy->data, pbuf, tmp_len); 1072 precvframe->u.hdr.rx_head = precvframe->u.hdr.rx_data = 1073 precvframe->u.hdr.rx_tail = pkt_copy->data; 1074 precvframe->u.hdr.rx_end = pkt_copy->data + alloc_sz; I added a BUG_ON there in case the memcpy overflows (BUG_ON((pkt_copy->end - pkt_copy->data) < tmp_len)) and it trigerred. I'm not sure why does the overflow occur though. Haggai -- To unsubscribe from this list: send the line "unsubscribe linux-wireless" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
On 19 May 2015 at 07:52, Larry Finger <Larry.Finger@lwfinger.net> wrote: > I checked the driver with Smatch and found a couple of array problems. These > likely won't be the problem, but try the attached patches anyway. I tried the patches. The first one prevents the driver from working. I think the smatch warning may be a false positive, because HWXMIT_ENTRY is checked specifically for values 4 and 5 in an if statement. The second patch doesn't hurt, but it didn't solve the issue. -- To unsubscribe from this list: send the line "unsubscribe linux-wireless" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
From 7729f6f1c7c6cb49b77b42e89e0e10be3121079b Mon Sep 17 00:00:00 2001 From: Larry Finger <Larry.Finger@lwfinger.net> Date: Mon, 18 May 2015 23:47:22 -0500 Subject: [PATCH 2/2] staging: rtl8712: Fix Smatch error in rtl8712_efuse.c Smatch reports the following error: drivers/staging/rtl8712/rtl8712_efuse.c:545 r8712_efuse_map_write() error: buffer overflow 'pktdata' 8 <= 8 Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net> --- drivers/staging/rtl8712/rtl8712_efuse.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/staging/rtl8712/rtl8712_efuse.c b/drivers/staging/rtl8712/rtl8712_efuse.c index d957169..dfe6cd7 100644 --- a/drivers/staging/rtl8712/rtl8712_efuse.c +++ b/drivers/staging/rtl8712/rtl8712_efuse.c @@ -495,7 +495,7 @@ u8 r8712_efuse_map_write(struct _adapter *padapter, u16 addr, u16 cnts, u8 *data) { u8 offset, word_en, empty; - u8 pktdata[PGPKT_DATA_SIZE], newdata[PGPKT_DATA_SIZE]; + u8 pktdata[PGPKT_DATA_SIZE + 1], newdata[PGPKT_DATA_SIZE + 1]; int i, j, idx; if ((addr + cnts) > EFUSE_MAP_MAX_SIZE) -- 2.1.4