public-mirrors/linux
1
0
Fork 0
mirror of git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2025-08-05 16:54:27 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

NET: wimax, fix use after free

Browse source 
Stanse found that i2400m_rx frees skb, but still uses skb->len even
though it has skb_len defined. So use skb_len properly in the code.

And also define it unsinged int rather than size_t to solve
compilation warnings.

Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Cc: Inaky Perez-Gonzalez <inaky.perez-gonzalez@intel.com>
Cc: linux-wimax@intel.com
Acked-by: Inaky Perez-Gonzalez <inaky.perez-gonzalez@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Jiri Slaby 2010-10-10 23:26:58 +00:00 • committed by David S. Miller
parent ec622ab072
commit 0aa7deadff
1 changed files with 13 additions and 13 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

26
drivers/net/wimax/i2400m/rx.c
View file

@ -1244,16 +1244,16 @@ int i2400m_rx(struct i2400m *i2400m, struct sk_buff *skb)
int i, result; int i, result;
struct device *dev = i2400m_dev(i2400m); struct device *dev = i2400m_dev(i2400m);
const struct i2400m_msg_hdr *msg_hdr; const struct i2400m_msg_hdr *msg_hdr;
size_t pl_itr, pl_size, skb_len; size_t pl_itr, pl_size;
unsigned long flags; unsigned long flags;
unsigned num_pls, single_last; unsigned num_pls, single_last, skb_len;
skb_len = skb->len; skb_len = skb->len;
d_fnstart(4, dev, "(i2400m %p skb %p [size %zu])\n", d_fnstart(4, dev, "(i2400m %p skb %p [size %u])\n",
i2400m, skb, skb_len); i2400m, skb, skb_len);
result = -EIO; result = -EIO;
msg_hdr = (void *) skb->data; msg_hdr = (void *) skb->data;
result = i2400m_rx_msg_hdr_check(i2400m, msg_hdr, skb->len); result = i2400m_rx_msg_hdr_check(i2400m, msg_hdr, skb_len);
if (result < 0) if (result < 0)
goto error_msg_hdr_check; goto error_msg_hdr_check;
result = -EIO; result = -EIO;
@ -1261,10 +1261,10 @@ int i2400m_rx(struct i2400m *i2400m, struct sk_buff *skb)
pl_itr = sizeof(*msg_hdr) + /* Check payload descriptor(s) */ pl_itr = sizeof(*msg_hdr) + /* Check payload descriptor(s) */
num_pls * sizeof(msg_hdr->pld[0]); num_pls * sizeof(msg_hdr->pld[0]);
pl_itr = ALIGN(pl_itr, I2400M_PL_ALIGN); pl_itr = ALIGN(pl_itr, I2400M_PL_ALIGN);
if (pl_itr > skb->len) { /* got all the payload descriptors? */ if (pl_itr > skb_len) { /* got all the payload descriptors? */
dev_err(dev, "RX: HW BUG? message too short (%u bytes) for " dev_err(dev, "RX: HW BUG? message too short (%u bytes) for "
"%u payload descriptors (%zu each, total %zu)\n", "%u payload descriptors (%zu each, total %zu)\n",
skb->len, num_pls, sizeof(msg_hdr->pld[0]), pl_itr); skb_len, num_pls, sizeof(msg_hdr->pld[0]), pl_itr);
goto error_pl_descr_short; goto error_pl_descr_short;
} }
/* Walk each payload payload--check we really got it */ /* Walk each payload payload--check we really got it */
@ -1272,7 +1272,7 @@ int i2400m_rx(struct i2400m *i2400m, struct sk_buff *skb)
/* work around old gcc warnings */ /* work around old gcc warnings */
pl_size = i2400m_pld_size(&msg_hdr->pld[i]); pl_size = i2400m_pld_size(&msg_hdr->pld[i]);
result = i2400m_rx_pl_descr_check(i2400m, &msg_hdr->pld[i], result = i2400m_rx_pl_descr_check(i2400m, &msg_hdr->pld[i],
pl_itr, skb->len); pl_itr, skb_len);
if (result < 0) if (result < 0)
goto error_pl_descr_check; goto error_pl_descr_check;
single_last = num_pls == 1 || i == num_pls - 1; single_last = num_pls == 1 || i == num_pls - 1;
@ -1290,16 +1290,16 @@ int i2400m_rx(struct i2400m *i2400m, struct sk_buff *skb)
if (i < i2400m->rx_pl_min) if (i < i2400m->rx_pl_min)
i2400m->rx_pl_min = i; i2400m->rx_pl_min = i;
i2400m->rx_num++; i2400m->rx_num++;
i2400m->rx_size_acc += skb->len; i2400m->rx_size_acc += skb_len;
if (skb->len < i2400m->rx_size_min) if (skb_len < i2400m->rx_size_min)
i2400m->rx_size_min = skb->len; i2400m->rx_size_min = skb_len;
if (skb->len > i2400m->rx_size_max) if (skb_len > i2400m->rx_size_max)
i2400m->rx_size_max = skb->len; i2400m->rx_size_max = skb_len;
spin_unlock_irqrestore(&i2400m->rx_lock, flags); spin_unlock_irqrestore(&i2400m->rx_lock, flags);
error_pl_descr_check: error_pl_descr_check:
error_pl_descr_short: error_pl_descr_short:
error_msg_hdr_check: error_msg_hdr_check:
d_fnend(4, dev, "(i2400m %p skb %p [size %zu]) = %d\n", d_fnend(4, dev, "(i2400m %p skb %p [size %u]) = %d\n",
i2400m, skb, skb_len, result); i2400m, skb, skb_len, result);
return result; return result;
} }