From 649e766a64a0d001f040dfc225c601b3d0af6f40 Mon Sep 17 00:00:00 2001 From: Felix Fietkau Date: Thu, 2 Feb 2017 12:02:22 +0100 Subject: mac80211: update to wireless-testing 2017-01-31 Signed-off-by: Felix Fietkau --- ...x-memory-leak-in-handling-rxdesc16-packet.patch | 34 ---------------------- 1 file changed, 34 deletions(-) delete mode 100644 package/kernel/mac80211/patches/650-0001-rtl8xxxu-Fix-memory-leak-in-handling-rxdesc16-packet.patch (limited to 'package/kernel/mac80211/patches/650-0001-rtl8xxxu-Fix-memory-leak-in-handling-rxdesc16-packet.patch') diff --git a/package/kernel/mac80211/patches/650-0001-rtl8xxxu-Fix-memory-leak-in-handling-rxdesc16-packet.patch b/package/kernel/mac80211/patches/650-0001-rtl8xxxu-Fix-memory-leak-in-handling-rxdesc16-packet.patch deleted file mode 100644 index 31604b6264..0000000000 --- a/package/kernel/mac80211/patches/650-0001-rtl8xxxu-Fix-memory-leak-in-handling-rxdesc16-packet.patch +++ /dev/null @@ -1,34 +0,0 @@ -From 51be39337a10a8bf9d8ec65419e78b76bf5adf60 Mon Sep 17 00:00:00 2001 -From: Jes Sorensen -Date: Wed, 28 Sep 2016 14:48:51 -0400 -Subject: [PATCH] rtl8xxxu: Fix memory leak in handling rxdesc16 packets - -A device running without RX package aggregation could return more data -in the USB packet than the actual network packet. In this case the -could would clone the skb but then determine that that there was no -packet to handle and exit without freeing the cloned skb first. - -This has so far only been observed with 8188eu devices, but could -affect others. - -Signed-off-by: Jes Sorensen ---- - drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c | 7 ++++++- - 1 file changed, 6 insertions(+), 1 deletion(-) - ---- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c -+++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c -@@ -5197,7 +5197,12 @@ int rtl8xxxu_parse_rxdesc16(struct rtl8x - pkt_offset = roundup(pkt_len + drvinfo_sz + desc_shift + - sizeof(struct rtl8xxxu_rxdesc16), 128); - -- if (pkt_cnt > 1) -+ /* -+ * Only clone the skb if there's enough data at the end to -+ * at least cover the rx descriptor -+ */ -+ if (pkt_cnt > 1 && -+ urb_len > (pkt_offset + sizeof(struct rtl8xxxu_rxdesc16))) - next_skb = skb_clone(skb, GFP_ATOMIC); - - rx_status = IEEE80211_SKB_RXCB(skb); -- cgit v1.2.3