diff options
| author |   Jakub Kicinski <kubakici@wp.pl> | 2015-06-02 21:11:26 +0200 |
|---|---|---|
| committer |   Kalle Valo <kvalo@codeaurora.org> | 2015-06-08 14:28:07 +0300 |
| commit | 2af6d21fce9990630d2adfda5a329706aa9e3571 (patch) | |
| tree | babecf7391ea6c31aba4584b34fc5fb994d0200e /drivers/net/wireless/mediatek/mt7601u/dma.c | |
| parent | mt7601u: unify paged and non-paged RX dma paths (diff) | |
| download | linux-dev-2af6d21fce9990630d2adfda5a329706aa9e3571.tar.xz linux-dev-2af6d21fce9990630d2adfda5a329706aa9e3571.zip | |
mt7601u: watch out for invalid-length frames
Users of older Ralink devices report that received frames
sometimes have zero length. Watch out for that.
Signed-off-by: Jakub Kicinski <kubakici@wp.pl>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Diffstat (limited to 'drivers/net/wireless/mediatek/mt7601u/dma.c')
| -rw-r--r-- | drivers/net/wireless/mediatek/mt7601u/dma.c | 14 |
1 files changed, 12 insertions, 2 deletions
diff --git a/drivers/net/wireless/mediatek/mt7601u/dma.c b/drivers/net/wireless/mediatek/mt7601u/dma.c index 16df67b2e62c..7217da4f1543 100644 --- a/drivers/net/wireless/mediatek/mt7601u/dma.c +++ b/drivers/net/wireless/mediatek/mt7601u/dma.c @@ -37,16 +37,20 @@ mt7601u_rx_skb_from_seg(struct mt7601u_dev *dev, struct mt7601u_rxwi *rxwi, void *data, u32 seg_len, u32 truesize, struct page *p) { struct sk_buff *skb; - u32 true_len; - int hdr_len, copy, frag; + u32 true_len, hdr_len = 0, copy, frag; skb = alloc_skb(p ? 128 : seg_len, GFP_ATOMIC); if (!skb) return NULL; true_len = mt76_mac_process_rx(dev, skb, data, rxwi); + if (!true_len || true_len > seg_len) + goto bad_frame; hdr_len = ieee80211_get_hdrlen_from_buf(data, true_len); + if (!hdr_len) + goto bad_frame; + if (rxwi->rxinfo & cpu_to_le32(MT_RXINFO_L2PAD)) { memcpy(skb_put(skb, hdr_len), data, hdr_len); @@ -69,6 +73,12 @@ mt7601u_rx_skb_from_seg(struct mt7601u_dev *dev, struct mt7601u_rxwi *rxwi, } return skb; + +bad_frame: + dev_err_ratelimited(dev->dev, "Error: incorrect frame len:%u hdr:%u\n", + true_len, hdr_len); + dev_kfree_skb(skb); + return NULL; } static void mt7601u_rx_process_seg(struct mt7601u_dev *dev, u8 *data, |