diff options
| author | nbd <nbd@3c298f89-4303-0410-b956-a3cf2f4a3e73> | 2008-01-26 04:19:50 +0000 |
|---|---|---|
| committer | nbd <nbd@3c298f89-4303-0410-b956-a3cf2f4a3e73> | 2008-01-26 04:19:50 +0000 |
| commit | 3610f7a9eec2bfdc902e0928dccf28e93734f704 (patch) | |
| tree | a518ab065d62fc58fcbde940466cc3fa895e2a2b /package/madwifi/patches | |
| parent | adeafa7cfb999ddd12dfd945a37feeaaf83686df (diff) | |
add extra sanity checks in madwifi
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@10266 3c298f89-4303-0410-b956-a3cf2f4a3e73
Diffstat (limited to 'package/madwifi/patches')
| -rw-r--r-- | package/madwifi/patches/316-skb_checks.patch | 61 |
1 files changed, 61 insertions, 0 deletions
diff --git a/package/madwifi/patches/316-skb_checks.patch b/package/madwifi/patches/316-skb_checks.patch new file mode 100644 index 000000000..de6d551e5 --- /dev/null +++ b/package/madwifi/patches/316-skb_checks.patch @@ -0,0 +1,61 @@ +Index: madwifi-dfs-r3252/net80211/ieee80211_input.c +=================================================================== +--- madwifi-dfs-r3252.orig/net80211/ieee80211_input.c 2008-01-26 05:14:46.815962139 +0100 ++++ madwifi-dfs-r3252/net80211/ieee80211_input.c 2008-01-26 05:18:37.005079863 +0100 +@@ -740,8 +740,10 @@ + + skb1 = skb_copy(skb, GFP_ATOMIC); + /* Increment reference count after copy */ +- if (skb1 != NULL) +- ieee80211_skb_copy_noderef(skb, skb1); ++ if (skb1 == NULL) ++ goto err; ++ ++ ieee80211_skb_copy_noderef(skb, skb1); + + /* we now have 802.3 MAC hdr followed by 802.2 LLC/SNAP; convert to EthernetII. + * Note that the frame is at least IEEE80211_MIN_LEN, due to the driver code. */ +@@ -1055,9 +1057,11 @@ + * assemble fragments + */ + ni->ni_rxfrag = skb_copy(skb, GFP_ATOMIC); +- /* We duplicate the reference after skb_copy */ +- ieee80211_skb_copy_noderef(skb, ni->ni_rxfrag); +- ieee80211_dev_kfree_skb(&skb); ++ if (ni->ni_rxfrag) { ++ /* We duplicate the reference after skb_copy */ ++ ieee80211_skb_copy_noderef(skb, ni->ni_rxfrag); ++ ieee80211_dev_kfree_skb(&skb); ++ } + } + /* + * Check that we have enough space to hold +@@ -1071,7 +1075,7 @@ + (skb_end_pointer(skb) - skb->head), + GFP_ATOMIC); + /* We duplicate the reference after skb_copy */ +- if (skb != ni->ni_rxfrag) ++ if ((skb != ni->ni_rxfrag) && ni->ni_rxfrag) + ieee80211_skb_copy_noderef(skb, ni->ni_rxfrag); + ieee80211_dev_kfree_skb(&skb); + } +@@ -1134,7 +1138,8 @@ + if (ETHER_IS_MULTICAST(eh->ether_dhost)) { + skb1 = skb_copy(skb, GFP_ATOMIC); + /* Use the BSS node for retransmitting this multicast frame */ +- SKB_CB(skb1)->ni = ieee80211_ref_node(vap->iv_bss); ++ if (skb1) ++ SKB_CB(skb1)->ni = ieee80211_ref_node(vap->iv_bss); + } + else { + /* +@@ -1277,6 +1282,9 @@ + + /* XXX: does this always work? */ + tskb = skb_copy(skb, GFP_ATOMIC); ++ if (!tskb) ++ return skb; ++ + /* We duplicate the reference after skb_copy */ + ieee80211_skb_copy_noderef(skb, tskb); + ieee80211_dev_kfree_skb(&skb); |