aboutsummaryrefslogtreecommitdiffstats
path: root/package/madwifi/patches
diff options
context:
space:
mode:
authorFelix Fietkau <nbd@openwrt.org>2008-01-26 04:19:50 +0000
committerFelix Fietkau <nbd@openwrt.org>2008-01-26 04:19:50 +0000
commitd7b86662f7fccf36e3091cdd5f7116d0a0a28279 (patch)
tree42b167ef21d55ddec28db94cd0f57c97e832a2a3 /package/madwifi/patches
parent5411061a03b8ecfaf06e7c21d6e5ae51e275c005 (diff)
downloadupstream-d7b86662f7fccf36e3091cdd5f7116d0a0a28279.tar.gz
upstream-d7b86662f7fccf36e3091cdd5f7116d0a0a28279.tar.bz2
upstream-d7b86662f7fccf36e3091cdd5f7116d0a0a28279.zip
add extra sanity checks in madwifi
SVN-Revision: 10266
Diffstat (limited to 'package/madwifi/patches')
-rw-r--r--package/madwifi/patches/316-skb_checks.patch61
1 files changed, 61 insertions, 0 deletions
diff --git a/package/madwifi/patches/316-skb_checks.patch b/package/madwifi/patches/316-skb_checks.patch
new file mode 100644
index 0000000000..de6d551e51
--- /dev/null
+++ b/package/madwifi/patches/316-skb_checks.patch
@@ -0,0 +1,61 @@
+Index: madwifi-dfs-r3252/net80211/ieee80211_input.c
+===================================================================
+--- madwifi-dfs-r3252.orig/net80211/ieee80211_input.c 2008-01-26 05:14:46.815962139 +0100
++++ madwifi-dfs-r3252/net80211/ieee80211_input.c 2008-01-26 05:18:37.005079863 +0100
+@@ -740,8 +740,10 @@
+
+ skb1 = skb_copy(skb, GFP_ATOMIC);
+ /* Increment reference count after copy */
+- if (skb1 != NULL)
+- ieee80211_skb_copy_noderef(skb, skb1);
++ if (skb1 == NULL)
++ goto err;
++
++ ieee80211_skb_copy_noderef(skb, skb1);
+
+ /* we now have 802.3 MAC hdr followed by 802.2 LLC/SNAP; convert to EthernetII.
+ * Note that the frame is at least IEEE80211_MIN_LEN, due to the driver code. */
+@@ -1055,9 +1057,11 @@
+ * assemble fragments
+ */
+ ni->ni_rxfrag = skb_copy(skb, GFP_ATOMIC);
+- /* We duplicate the reference after skb_copy */
+- ieee80211_skb_copy_noderef(skb, ni->ni_rxfrag);
+- ieee80211_dev_kfree_skb(&skb);
++ if (ni->ni_rxfrag) {
++ /* We duplicate the reference after skb_copy */
++ ieee80211_skb_copy_noderef(skb, ni->ni_rxfrag);
++ ieee80211_dev_kfree_skb(&skb);
++ }
+ }
+ /*
+ * Check that we have enough space to hold
+@@ -1071,7 +1075,7 @@
+ (skb_end_pointer(skb) - skb->head),
+ GFP_ATOMIC);
+ /* We duplicate the reference after skb_copy */
+- if (skb != ni->ni_rxfrag)
++ if ((skb != ni->ni_rxfrag) && ni->ni_rxfrag)
+ ieee80211_skb_copy_noderef(skb, ni->ni_rxfrag);
+ ieee80211_dev_kfree_skb(&skb);
+ }
+@@ -1134,7 +1138,8 @@
+ if (ETHER_IS_MULTICAST(eh->ether_dhost)) {
+ skb1 = skb_copy(skb, GFP_ATOMIC);
+ /* Use the BSS node for retransmitting this multicast frame */
+- SKB_CB(skb1)->ni = ieee80211_ref_node(vap->iv_bss);
++ if (skb1)
++ SKB_CB(skb1)->ni = ieee80211_ref_node(vap->iv_bss);
+ }
+ else {
+ /*
+@@ -1277,6 +1282,9 @@
+
+ /* XXX: does this always work? */
+ tskb = skb_copy(skb, GFP_ATOMIC);
++ if (!tskb)
++ return skb;
++
+ /* We duplicate the reference after skb_copy */
+ ieee80211_skb_copy_noderef(skb, tskb);
+ ieee80211_dev_kfree_skb(&skb);