2015-05-23 20:14:18

by Haggai Eran

Subject: [PATCH v1] staging: rtl8712: prevent buffer overrun in recvbuf2recvframe

With an RTL8191SU USB adaptor, sometimes the hints for a fragmented
packet are set, but the packet length is too large. Allocate enough
space to prevent memory corruption and a resulting kernel panic [1].

[1] http://www.spinics.net/lists/linux-wireless/msg136546.html

Cc: <[email protected]>
Signed-off-by: Haggai Eran <[email protected]>
---
Hi Larry,

I've updated the patch to avoid truncating the packets. I'm keeping the minimal
buffer of 1658 bytes in case some other device does rely on this
defragmentation feature.

Regards,
Haggai

drivers/staging/rtl8712/rtl8712_recv.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/staging/rtl8712/rtl8712_recv.c b/drivers/staging/rtl8712/rtl8712_recv.c
index cd8b444..5542243 100644
--- a/drivers/staging/rtl8712/rtl8712_recv.c
+++ b/drivers/staging/rtl8712/rtl8712_recv.c
@@ -1056,7 +1056,8 @@ static int recvbuf2recvframe(struct _adapter *padapter, struct sk_buff *pskb)
/* for first fragment packet, driver need allocate 1536 +
* drvinfo_sz + RXDESC_SIZE to defrag packet. */
if ((mf == 1) && (frag == 0))
- alloc_sz = 1658;/*1658+6=1664, 1664 is 128 alignment.*/
+ /*1658+6=1664, 1664 is 128 alignment.*/
+ alloc_sz = max_t(u16, tmp_len, 1658);
else
alloc_sz = tmp_len;
/* 2 is for IP header 4 bytes alignment in QoS packet case.
--
1.9.1

2015-05-23 21:06:33

by Larry Finger

Subject: Re: [PATCH v1] staging: rtl8712: prevent buffer overrun in recvbuf2recvframe

On 05/23/2015 03:13 PM, Haggai Eran wrote:
> With an RTL8191SU USB adaptor, sometimes the hints for a fragmented
> packet are set, but the packet length is too large. Allocate enough
> space to prevent memory corruption and a resulting kernel panic [1].
>
> [1] http://www.spinics.net/lists/linux-wireless/msg136546.html
>
> Cc: <[email protected]>
> Signed-off-by: Haggai Eran <[email protected]>

ACKed-by: Larry Finger <[email protected]>

Thanks,

Larry

> ---
> Hi Larry,
>
> I've updated the patch to avoid truncating the packets. I'm keeping the minimal
> buffer of 1658 bytes in case some other device does rely on this
> defragmentation feature.
>
> Regards,
> Haggai
>
> drivers/staging/rtl8712/rtl8712_recv.c | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/staging/rtl8712/rtl8712_recv.c b/drivers/staging/rtl8712/rtl8712_recv.c
> index cd8b444..5542243 100644
> --- a/drivers/staging/rtl8712/rtl8712_recv.c
> +++ b/drivers/staging/rtl8712/rtl8712_recv.c
> @@ -1056,7 +1056,8 @@ static int recvbuf2recvframe(struct _adapter *padapter, struct sk_buff *pskb)
> /* for first fragment packet, driver need allocate 1536 +
> * drvinfo_sz + RXDESC_SIZE to defrag packet. */
> if ((mf == 1) && (frag == 0))
> - alloc_sz = 1658;/*1658+6=1664, 1664 is 128 alignment.*/
> + /*1658+6=1664, 1664 is 128 alignment.*/
> + alloc_sz = max_t(u16, tmp_len, 1658);
> else
> alloc_sz = tmp_len;
> /* 2 is for IP header 4 bytes alignment in QoS packet case.
>