* [PATCH V3] rtlwifi: rtl_pci: Fix problem of too small skb->len
@ 2019-10-21 0:56 Larry Finger
2019-10-21 13:53 ` Kalle Valo
2019-10-23 10:33 ` Kalle Valo
0 siblings, 2 replies; 3+ messages in thread
From: Larry Finger @ 2019-10-21 0:56 UTC (permalink / raw)
To: kvalo; +Cc: linux-wireless, pkshih, Larry Finger, Stable
In commit 8020919a9b99 ("mac80211: Properly handle SKB with radiotap
only"), buffers whose length is too short cause a WARN_ON(1) to be
executed. This change exposed a fault in rtlwifi drivers, which is fixed
by regarding packets with skb->len <= FCS_LEN as though they are in error
and dropping them. The test is now annotated as likely.
Cc: Stable <stable@vger.kernel.org> # v5.0+
Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
---
V2 - content dropped
V3 - changed fix to drop packet rather than arbitrarily increasing the length.
---
Material for 5.4.
---
drivers/net/wireless/realtek/rtlwifi/pci.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/net/wireless/realtek/rtlwifi/pci.c b/drivers/net/wireless/realtek/rtlwifi/pci.c
index 6087ec7a90a6..f88d26535978 100644
--- a/drivers/net/wireless/realtek/rtlwifi/pci.c
+++ b/drivers/net/wireless/realtek/rtlwifi/pci.c
@@ -822,7 +822,7 @@ static void _rtl_pci_rx_interrupt(struct ieee80211_hw *hw)
hdr = rtl_get_hdr(skb);
fc = rtl_get_fc(skb);
- if (!stats.crc && !stats.hwerror) {
+ if (!stats.crc && !stats.hwerror && (skb->len > FCS_LEN)) {
memcpy(IEEE80211_SKB_RXCB(skb), &rx_status,
sizeof(rx_status));
@@ -859,6 +859,7 @@ static void _rtl_pci_rx_interrupt(struct ieee80211_hw *hw)
_rtl_pci_rx_to_mac80211(hw, skb, rx_status);
}
} else {
+ /* drop packets with errors or those too short */
dev_kfree_skb_any(skb);
}
new_trx_end:
--
2.23.0
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH V3] rtlwifi: rtl_pci: Fix problem of too small skb->len
2019-10-21 0:56 [PATCH V3] rtlwifi: rtl_pci: Fix problem of too small skb->len Larry Finger
@ 2019-10-21 13:53 ` Kalle Valo
2019-10-23 10:33 ` Kalle Valo
1 sibling, 0 replies; 3+ messages in thread
From: Kalle Valo @ 2019-10-21 13:53 UTC (permalink / raw)
To: Larry Finger; +Cc: linux-wireless, pkshih, Stable
Larry Finger <Larry.Finger@lwfinger.net> writes:
> In commit 8020919a9b99 ("mac80211: Properly handle SKB with radiotap
> only"), buffers whose length is too short cause a WARN_ON(1) to be
> executed. This change exposed a fault in rtlwifi drivers, which is fixed
> by regarding packets with skb->len <= FCS_LEN as though they are in error
> and dropping them. The test is now annotated as likely.
>
> Cc: Stable <stable@vger.kernel.org> # v5.0+
> Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
> ---
> V2 - content dropped
> V3 - changed fix to drop packet rather than arbitrarily increasing the length.
Much better, thanks.
> Material for 5.4.
Ok, I'll queue it for v5.4.
--
https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH V3] rtlwifi: rtl_pci: Fix problem of too small skb->len
2019-10-21 0:56 [PATCH V3] rtlwifi: rtl_pci: Fix problem of too small skb->len Larry Finger
2019-10-21 13:53 ` Kalle Valo
@ 2019-10-23 10:33 ` Kalle Valo
1 sibling, 0 replies; 3+ messages in thread
From: Kalle Valo @ 2019-10-23 10:33 UTC (permalink / raw)
To: Larry Finger; +Cc: linux-wireless, pkshih, Larry Finger, Stable
Larry Finger <Larry.Finger@lwfinger.net> wrote:
> In commit 8020919a9b99 ("mac80211: Properly handle SKB with radiotap
> only"), buffers whose length is too short cause a WARN_ON(1) to be
> executed. This change exposed a fault in rtlwifi drivers, which is fixed
> by regarding packets with skb->len <= FCS_LEN as though they are in error
> and dropping them. The test is now annotated as likely.
>
> Cc: Stable <stable@vger.kernel.org> # v5.0+
> Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Patch applied to wireless-drivers.git, thanks.
b43f4a169f22 rtlwifi: rtl_pci: Fix problem of too small skb->len
--
https://patchwork.kernel.org/patch/11201179/
https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2019-10-23 10:33 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-10-21 0:56 [PATCH V3] rtlwifi: rtl_pci: Fix problem of too small skb->len Larry Finger
2019-10-21 13:53 ` Kalle Valo
2019-10-23 10:33 ` Kalle Valo
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.