Commit a220858d authored Mar 23, 2009 by Johannes Berg Committed by John W. Linville Mar 27, 2009

mac80211: add skb length sanity checking



We just found a bug in zd1211rw where it would reject
packets in the ->tx() method but leave them modified,
which would cause retransmit attempts with completely
bogus skbs, eventually leading to a panic due to not
having enough headroom in those.

This patch adds a sanity check to mac80211 to catch
such driver mistakes; in this case we warn and drop
the skb.

Signed-off-by: Johannes Berg <johannes@sipsolutions.net>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

parent b1720231

net/mac80211/tx.c

+6 −1

Original line number	Diff line number	Diff line
		@@ -1089,7 +1089,7 @@ static int __ieee80211_tx(struct ieee80211_local *local,
		{
		struct sk_buff skb = skbp, *next;
		struct ieee80211_tx_info *info;
		int ret;
		int ret, len;
		bool fragm = false;

		local->mdev->trans_start = jiffies;
		@@ -1125,7 +1125,12 @@ static int __ieee80211_tx(struct ieee80211_local *local,
		}

		next = skb->next;
		len = skb->len;
		ret = local->ops->tx(local_to_hw(local), skb);
		if (WARN_ON(ret != NETDEV_TX_OK && skb->len != len)) {
		dev_kfree_skb(skb);
		ret = NETDEV_TX_OK;
		}
		if (ret != NETDEV_TX_OK)
		return IEEE80211_TX_AGAIN;
		*skbp = skb = next;

Admin message