Bug Patch

[Sudip Mukherjee]

On Mon, Sep 08, 2014 at 06:36:34AM -0400, nick wrote:
> Hey Guys,
> Found a bug and attempted to fix it. I am attaching the patch, no build or checkpatch errors and
> also checked to see if I need to clean up any memory when returning, and this seems to be true.
> Nick 

> >From d5f7b8929bebcf0b12d8e402932b790f61786168 Mon Sep 17 00:00:00 2001
> From: Nicholas Krause <xerofoify at gmail.com>
> Date: Mon, 8 Sep 2014 05:57:09 -0400
> Subject: [PATCH] staging: Fix ieee_80211_rx.c to check for Null allocated skb
> 
> In ieee_80211_rx.c we may have a Null allocated sub in parse_subframe
> and need to check if the allocated skb is NUll. If it is return -ENOMEM.
> 
> Signed-off-by: Nicholas Krause <xerofoify at gmail.com>
> ---
>  drivers/staging/rtl8192u/ieee80211/ieee80211_rx.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/drivers/staging/rtl8192u/ieee80211/ieee80211_rx.c b/drivers/staging/rtl8192u/ieee80211/ieee80211_rx.c
> index 73410cc..dc8520d 100644
> --- a/drivers/staging/rtl8192u/ieee80211/ieee80211_rx.c
> +++ b/drivers/staging/rtl8192u/ieee80211/ieee80211_rx.c
> @@ -847,6 +847,8 @@ static u8 parse_subframe(struct sk_buff *skb,
>  #else
>  			/* Allocate new skb for releasing to upper layer */
>  			sub_skb = dev_alloc_skb(nSubframe_Length + 12);
> +			if (!sub_skb)
> +				return -ENOMEM;
parse_subframe is returning 0 as error.
if you see the functions that are calling parse_subframe , you will see they are comparing the
return value with zero for failure. So you are returning -ENOMEM that is a success and 
it will try to process that frame , and i hope you can imagine what happens next.

thanks
sudip

>  			skb_reserve(sub_skb, 12);
>  			data_ptr = (u8 *)skb_put(sub_skb, nSubframe_Length);
>  			memcpy(data_ptr,skb->data,nSubframe_Length);
> --
> 1.9.1
> 

> _______________________________________________
> Kernelnewbies mailing list
> Kernelnewbies at kernelnewbies.org
> http://lists.kernelnewbies.org/mailman/listinfo/kernelnewbies