mwifiex: avoid processing RX packets with invalid length (42a028aa) · Commits · 戴 / test

If rx_len received in interface header from FW is more than RX buffer size, skb_put for such length results into skb_panic. Avoid this by not processing such packets. We just print a warning for such packets and free skb. Reviewed-by:

Paul Stewart <pstew@chromium.org> Signed-off-by:

Avinash Patil <patila@marvell.com> Signed-off-by:

Amitkumar Karwar <akarwar@marvell.com> Signed-off-by:

Bing Zhao <bzhao@marvell.com> Signed-off-by:

Marc Yang <yangyang@marvell.com> Signed-off-by:

John W. Linville <linville@tuxdriver.com>

drivers/net/wireless/mwifiex/pcie.c

+14 −6

Original line number	Diff line number	Diff line
		@@ -1271,12 +1271,20 @@ static int mwifiex_pcie_process_recv_data(struct mwifiex_adapter *adapter)
		*/
		pkt_len = ((__le16 )skb_data->data);
		rx_len = le16_to_cpu(pkt_len);
		if (WARN_ON(rx_len <= INTF_HEADER_LEN \|\|
		rx_len > MWIFIEX_RX_DATA_BUF_SIZE)) {
		dev_err(adapter->dev,
		"Invalid RX len %d, Rd=%#x, Wr=%#x\n",
		rx_len, card->rxbd_rdptr, wrptr);
		dev_kfree_skb_any(skb_data);
		} else {
		skb_put(skb_data, rx_len);
		dev_dbg(adapter->dev,
		"info: RECV DATA: Rd=%#x, Wr=%#x, Len=%d\n",
		card->rxbd_rdptr, wrptr, rx_len);
		skb_pull(skb_data, INTF_HEADER_LEN);
		mwifiex_handle_rx_packet(adapter, skb_data);
		}

		skb_tmp = dev_alloc_skb(MWIFIEX_RX_DATA_BUF_SIZE);
		if (!skb_tmp) {

Admin message