linux-kernel - [PATCH 3.2 15/94] mwifiex: fix Tx timeout issue

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Mon, 04 Aug 2014 17:48:31 +0100
From:	Ben Hutchings <ben@...adent.org.uk>
To:	linux-kernel@...r.kernel.org, stable@...r.kernel.org
CC:	akpm@...ux-foundation.org,
	"Linus Gasser" <list@...kas-al-nour.org>,
	"Maithili Hinge" <maithili@...vell.com>,
	"Andrew Wiley" <wiley.andrew.j@...il.com>,
	"Bing Zhao" <bzhao@...vell.com>, "Xinming Hu" <huxm@...vell.com>,
	"Amitkumar Karwar" <akarwar@...vell.com>,
	"John W. Linville" <linville@...driver.com>,
	"Avinash Patil" <patila@...vell.com>,
	"Michael Hirsch" <hirsch@...fel.de>
Subject: [PATCH 3.2 15/94] mwifiex: fix Tx timeout issue

3.2.62-rc1 review patch.  If anyone has any objections, please let me know.

------------------

From: Amitkumar Karwar <akarwar@...vell.com>

commit d76744a93246eccdca1106037e8ee29debf48277 upstream.

https://bugzilla.kernel.org/show_bug.cgi?id=70191
https://bugzilla.kernel.org/show_bug.cgi?id=77581

It is observed that sometimes Tx packet is downloaded without
adding driver's txpd header. This results in firmware parsing
garbage data as packet length. Sometimes firmware is unable
to read the packet if length comes out as invalid. This stops
further traffic and timeout occurs.

The root cause is uninitialized fields in tx_info(skb->cb) of
packet used to get garbage values. In this case if
MWIFIEX_BUF_FLAG_REQUEUED_PKT flag is mistakenly set, txpd
header was skipped. This patch makes sure that tx_info is
correctly initialized to fix the problem.

Reported-by: Andrew Wiley <wiley.andrew.j@...il.com>
Reported-by: Linus Gasser <list@...kas-al-nour.org>
Reported-by: Michael Hirsch <hirsch@...fel.de>
Tested-by: Xinming Hu <huxm@...vell.com>
Signed-off-by: Amitkumar Karwar <akarwar@...vell.com>
Signed-off-by: Maithili Hinge <maithili@...vell.com>
Signed-off-by: Avinash Patil <patila@...vell.com>
Signed-off-by: Bing Zhao <bzhao@...vell.com>
Signed-off-by: John W. Linville <linville@...driver.com>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <ben@...adent.org.uk>
---
 drivers/net/wireless/mwifiex/main.c | 1 +
 1 file changed, 1 insertion(+)

--- a/drivers/net/wireless/mwifiex/main.c
+++ b/drivers/net/wireless/mwifiex/main.c
@@ -458,6 +458,7 @@ mwifiex_hard_start_xmit(struct sk_buff *
 	}
 
 	tx_info = MWIFIEX_SKB_TXCB(skb);
+	memset(tx_info, 0, sizeof(*tx_info));
 	tx_info->bss_index = priv->bss_index;
 	mwifiex_fill_buffer(skb);
 

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/