linux-kernel - [PATCH 4/5] staging:r8188eu: eleminate recovery attemp using skb_clone after netdev_alloc

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20170104102218.12041-4-insafonov@gmail.com>
Date:   Wed,  4 Jan 2017 17:22:17 +0700
From:   Ivan Safonov <insafonov@...il.com>
To:     Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Cc:     Bhaktipriya Shridhar <bhaktipriya96@...il.com>,
        Ivan Safonov <insafonov@...il.com>,
        Luca Ceresoli <luca@...aceresoli.net>,
        Geliang Tang <geliangtang@....com>,
        Binoy Jayan <binoy.jayan@...aro.org>,
        Victor Carvajal <carva005@...il.com>,
        Pierre-Yves Kerbrat <pkerbrat@...e.fr>,
        devel@...verdev.osuosl.org, linux-kernel@...r.kernel.org
Subject: [PATCH 4/5] staging:r8188eu: eleminate recovery attemp using skb_clone after netdev_alloc_skb fail

It is wrong to create new skb using skb_clone instead netdev_alloc_skb,
because buffer data will be changed later.

Signed-off-by: Ivan Safonov <insafonov@...il.com>
---
 drivers/staging/rtl8188eu/os_dep/usb_ops_linux.c | 19 +++----------------
 1 file changed, 3 insertions(+), 16 deletions(-)

diff --git a/drivers/staging/rtl8188eu/os_dep/usb_ops_linux.c b/drivers/staging/rtl8188eu/os_dep/usb_ops_linux.c
index e2dbe1b..5f6cbe0 100644
--- a/drivers/staging/rtl8188eu/os_dep/usb_ops_linux.c
+++ b/drivers/staging/rtl8188eu/os_dep/usb_ops_linux.c
@@ -133,22 +133,9 @@ static int recvbuf2recvframe(struct adapter *adapt, struct sk_buff *pskb)
 			precvframe->rx_tail = pkt_copy->data;
 			precvframe->rx_data = pkt_copy->data;
 		} else {
-			if ((pattrib->mfrag == 1) && (pattrib->frag_num == 0)) {
-				DBG_88E("recvbuf2recvframe: alloc_skb fail , drop frag frame\n");
-				rtw_free_recvframe(precvframe, pfree_recv_queue);
-				goto _exit_recvbuf2recvframe;
-			}
-			precvframe->pkt = skb_clone(pskb, GFP_ATOMIC);
-			if (precvframe->pkt) {
-				precvframe->rx_tail = pbuf + pattrib->drvinfo_sz + RXDESC_SIZE;
-				precvframe->rx_head = precvframe->rx_tail;
-				precvframe->rx_data = precvframe->rx_tail;
-				precvframe->rx_end =  pbuf + pattrib->drvinfo_sz + RXDESC_SIZE + alloc_sz;
-			} else {
-				DBG_88E("recvbuf2recvframe: skb_clone fail\n");
-				rtw_free_recvframe(precvframe, pfree_recv_queue);
-				goto _exit_recvbuf2recvframe;
-			}
+			DBG_88E("recvbuf2recvframe: alloc_skb fail , drop frag frame\n");
+			rtw_free_recvframe(precvframe, pfree_recv_queue);
+			goto _exit_recvbuf2recvframe;
 		}
 
 		recvframe_put(precvframe, skb_len);
-- 
2.10.2