Commit 9181a6bd authored by David S. Miller's avatar David S. Miller
Browse files

Merge branch 'mac802154' 



Phoebe Buckheister says:

====================
Recent llsec code introduced a memory leak on decryption failures during rx.
This fixes said leak, and optimizes the receive loops for monitor and wpan
devices to only deliver skbs to devices that are actually up. Also changes a
dev_kfree_skb to kfree_skb when an invalid packet is dropped before being
pushed into the stack.
====================

Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents d5c48582 2d3b5b0a

net/mac802154/monitor.c

+2 −1
Original line number Diff line number Diff line
@@ -70,7 +70,8 @@ void mac802154_monitors_rx(struct mac802154_priv *priv, struct sk_buff *skb) 


	rcu_read_lock();

	list_for_each_entry_rcu(sdata, &priv->slaves, list) {

		if (sdata->type != IEEE802154_DEV_MONITOR)

		if (sdata->type != IEEE802154_DEV_MONITOR ||

		    !netif_running(sdata->dev))

			continue;



		skb2 = skb_clone(skb, GFP_ATOMIC);

net/mac802154/rx.c

+7 −4
Original line number Diff line number Diff line
@@ -64,20 +64,23 @@ mac802154_subif_rx(struct ieee802154_dev *hw, struct sk_buff *skb, u8 lqi) 


		if (skb->len < 2) {

			pr_debug("got invalid frame\n");

			goto out;

			goto fail;

		}

		crc = crc_ccitt(0, skb->data, skb->len);

		if (crc) {

			pr_debug("CRC mismatch\n");

			goto out;

			goto fail;

		}

		skb_trim(skb, skb->len - 2); /* CRC */

	}



	mac802154_monitors_rx(priv, skb);

	mac802154_wpans_rx(priv, skb);

out:

	dev_kfree_skb(skb);



	return;



fail:

	kfree_skb(skb);

}



static void mac802154_rx_worker(struct work_struct *work)

net/mac802154/wpan.c

+9 −5
Original line number Diff line number Diff line
@@ -472,6 +472,7 @@ mac802154_subif_frame(struct mac802154_sub_if_data *sdata, struct sk_buff *skb, 
	rc = mac802154_llsec_decrypt(&sdata->sec, skb);

	if (rc) {

		pr_debug("decryption failed: %i\n", rc);

		kfree_skb(skb);

		return NET_RX_DROP;

	}
@@ -566,7 +567,6 @@ static int mac802154_parse_frame_start(struct sk_buff *skb, 
void mac802154_wpans_rx(struct mac802154_priv *priv, struct sk_buff *skb)

{

	int ret;

	struct sk_buff *sskb;

	struct mac802154_sub_if_data *sdata;

	struct ieee802154_hdr hdr;
@@ -578,12 +578,16 @@ void mac802154_wpans_rx(struct mac802154_priv *priv, struct sk_buff *skb) 


	rcu_read_lock();

	list_for_each_entry_rcu(sdata, &priv->slaves, list) {

		if (sdata->type != IEEE802154_DEV_WPAN)

		if (sdata->type != IEEE802154_DEV_WPAN ||

		    !netif_running(sdata->dev))

			continue;



		sskb = skb_clone(skb, GFP_ATOMIC);

		if (sskb)

			mac802154_subif_frame(sdata, sskb, &hdr);

		mac802154_subif_frame(sdata, skb, &hdr);

		skb = NULL;

		break;

	}

	rcu_read_unlock();



	if (skb)

		kfree_skb(skb);

}

CRA Git | Maintained and supported by SUSTech CRA and CCSE