All of lore.kernel.org
 help / color / mirror / Atom feed
From: Alexander Aring <aar@pengutronix.de>
To: linux-wpan@vger.kernel.org
Cc: Alexander Aring <aar@pengutronix.de>
Subject: [PATCH bluetooth-next 2/5] mac802154: fix mac header length check
Date: Fri, 19 Feb 2016 09:59:11 +0100	[thread overview]
Message-ID: <1455872354-26032-2-git-send-email-aar@pengutronix.de> (raw)
In-Reply-To: <1455872354-26032-1-git-send-email-aar@pengutronix.de>

I got report about that sometimes the WARN_ON occurs there which should
never happen. I came to the conclusion that the mac header is there but
inside the headroom of skb. The skb->len information doesn't contain the
information about the headroom length and skb->len is lesser than two.

We check now if the skb_mac_header pointer is set and the room between
mac header pointer and tail pointer.

Signed-off-by: Alexander Aring <aar@pengutronix.de>
---
 include/net/mac802154.h | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/include/net/mac802154.h b/include/net/mac802154.h
index da574bb..2e3cdd20 100644
--- a/include/net/mac802154.h
+++ b/include/net/mac802154.h
@@ -247,8 +247,9 @@ struct ieee802154_ops {
  */
 static inline __le16 ieee802154_get_fc_from_skb(const struct sk_buff *skb)
 {
-	/* return some invalid fc on failure */
-	if (unlikely(skb->len < 2)) {
+	/* check if we can fc at skb_mac_header of sk buffer */
+	if (unlikely(!skb_mac_header_was_set(skb) ||
+		     (skb_tail_pointer(skb) - skb_mac_header(skb)) < 2)) {
 		WARN_ON(1);
 		return cpu_to_le16(0);
 	}
-- 
2.7.1


  reply	other threads:[~2016-02-19  8:59 UTC|newest]

Thread overview: 6+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2016-02-19  8:59 [PATCH bluetooth-next 1/5] MAINTAINERS: update 802.15.4 entries Alexander Aring
2016-02-19  8:59 ` Alexander Aring [this message]
2016-02-19  8:59 ` [PATCH bluetooth-next 3/5] at86rf230: fix race on error handling Alexander Aring
2016-02-19  8:59 ` [PATCH bluetooth-next 4/5] at86rf230: fix state change handling on error Alexander Aring
2016-02-19  8:59 ` [PATCH bluetooth-next 5/5] mrf24j40: add writeable missing reg Alexander Aring
2016-02-21  0:20 ` [PATCH bluetooth-next 1/5] MAINTAINERS: update 802.15.4 entries Marcel Holtmann

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=1455872354-26032-2-git-send-email-aar@pengutronix.de \
    --to=aar@pengutronix.de \
    --cc=linux-wpan@vger.kernel.org \
    --subject='Re: [PATCH bluetooth-next 2/5] mac802154: fix mac header length check' \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.