Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 11f16aef authored by Ismael Luceno's avatar Ismael Luceno Committed by John W. Linville
Browse files

rt2x00: Fix panic on frame padding for rt2800 usb devices 



Backtrace:
  rt2800usb_write_tx_data
  rt2x00queue_write_tx_frame
  rt2x00mac_tx
  invoke_tx_handlers
  __ieee80211_tx
  ieee80211_tx
  virt_to_head_page
  ieee80211_xmit
  ieee80211_tx_skb
  ieee80211_scan_work
  schedule
  ieee80211_scan_work
  process_one_work
  ...

It tried to expand the skb past it's end using skb_put. So I replaced it
with a call to skb_padto, which takes the issue into account.

Signed-off-by: default avatarIsmael Luceno <ismael.luceno@gmail.com>
Signed-off-by: default avatarIvo van Doorn <IvDoorn@gmail.com>
Signed-off-by: default avatarJohn W. Linville <linville@tuxdriver.com>
parent 736e3aca

drivers/net/wireless/rt2x00/rt2800usb.c

+12 −4
Original line number Diff line number Diff line
@@ -369,7 +369,10 @@ static void rt2800usb_write_tx_desc(struct queue_entry *entry, 
static void rt2800usb_write_tx_data(struct queue_entry *entry,

					struct txentry_desc *txdesc)

{

	u8 padding_len;

	unsigned int len;

	int err;



	rt2800_write_tx_data(entry, txdesc);



	/*

	 * pad(1~3 bytes) is added after each 802.11 payload.
@@ -378,9 +381,14 @@ static void rt2800usb_write_tx_data(struct queue_entry *entry, 
	 * | TXINFO | TXWI | 802.11 header | L2 pad | payload | pad | USB end pad |

	 *                 |<------------- tx_pkt_len ------------->|

	 */

        rt2800_write_tx_data(entry, txdesc);

        padding_len = roundup(entry->skb->len + 4, 4) - entry->skb->len;

        memset(skb_put(entry->skb, padding_len), 0, padding_len);

	len = roundup(entry->skb->len, 4) + 4;

	err = skb_padto(entry->skb, len);

	if (unlikely(err)) {

		WARNING(entry->queue->rt2x00dev, "TX SKB padding error, out of memory\n");

		return;

	}



	entry->skb->len = len;

}



/*