Commit b43f4a16 authored Oct 20, 2019 by Larry Finger Committed by Kalle Valo Oct 23, 2019

rtlwifi: rtl_pci: Fix problem of too small skb->len



In commit 8020919a ("mac80211: Properly handle SKB with radiotap
only"), buffers whose length is too short cause a WARN_ON(1) to be
executed. This change exposed a fault in rtlwifi drivers, which is fixed
by regarding packets with skb->len <= FCS_LEN as though they are in error
and dropping them. The test is now annotated as likely.

Cc: Stable <stable@vger.kernel.org> # v5.0+
Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>

parent 17c216ed

drivers/net/wireless/realtek/rtlwifi/pci.c

+2 −1

Original line number	Diff line number	Diff line
		@@ -822,7 +822,7 @@ static void _rtl_pci_rx_interrupt(struct ieee80211_hw *hw)
		hdr = rtl_get_hdr(skb);
		fc = rtl_get_fc(skb);

		if (!stats.crc && !stats.hwerror) {
		if (!stats.crc && !stats.hwerror && (skb->len > FCS_LEN)) {
		memcpy(IEEE80211_SKB_RXCB(skb), &rx_status,
		sizeof(rx_status));

		@@ -859,6 +859,7 @@ static void _rtl_pci_rx_interrupt(struct ieee80211_hw *hw)
		_rtl_pci_rx_to_mac80211(hw, skb, rx_status);
		}
		} else {
		/* drop packets with errors or those too short */
		dev_kfree_skb_any(skb);
		}
		new_trx_end: