linux-kernel - Re: [PATCH] staging:r8188eu: avoid skb

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20200423112910.GA3768232@kroah.com>
Date:   Thu, 23 Apr 2020 13:29:10 +0200
From:   Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To:     Ivan Safonov <insafonov@...il.com>
Cc:     Larry Finger <Larry.Finger@...inger.net>,
        devel@...verdev.osuosl.org, Puranjay Mohan <puranjay12@...il.com>,
        linux-kernel@...r.kernel.org,
        Saurav Girepunje <saurav.girepunje@...il.com>
Subject: Re: [PATCH] staging:r8188eu: avoid skb_clone for amsdu to msdu
 conversion

On Sat, Apr 18, 2020 at 11:41:12AM +0300, Ivan Safonov wrote:
> skb clones use same data buffer, so tail of one skb is corrupted by beginning of next skb.

Please properly wrap your changelog text at the correct column (72).

Also, your subject: line does not have the correct driver name :(

> 
> Signed-off-by: Ivan Safonov <insafonov@...il.com>
> ---
>  drivers/staging/rtl8188eu/core/rtw_recv.c | 19 ++++++-------------
>  1 file changed, 6 insertions(+), 13 deletions(-)
> 
> diff --git a/drivers/staging/rtl8188eu/core/rtw_recv.c b/drivers/staging/rtl8188eu/core/rtw_recv.c
> index d4278361e002..a036ef104198 100644
> --- a/drivers/staging/rtl8188eu/core/rtw_recv.c
> +++ b/drivers/staging/rtl8188eu/core/rtw_recv.c
> @@ -1525,21 +1525,14 @@ static int amsdu_to_msdu(struct adapter *padapter, struct recv_frame *prframe)
>  
>  		/* Allocate new skb for releasing to upper layer */
>  		sub_skb = dev_alloc_skb(nSubframe_Length + 12);
> -		if (sub_skb) {
> -			skb_reserve(sub_skb, 12);
> -			skb_put_data(sub_skb, pdata, nSubframe_Length);
> -		} else {
> -			sub_skb = skb_clone(prframe->pkt, GFP_ATOMIC);
> -			if (sub_skb) {
> -				sub_skb->data = pdata;
> -				sub_skb->len = nSubframe_Length;
> -				skb_set_tail_pointer(sub_skb, nSubframe_Length);
> -			} else {
> -				DBG_88E("skb_clone() Fail!!! , nr_subframes=%d\n", nr_subframes);
> -				break;
> -			}
> +		if (!sub_skb) {
> +			DBG_88E("dev_alloc_skb() Fail!!! , nr_subframes=%d\n", nr_subframes);
> +			break;
>  		}
>  
> +		skb_reserve(sub_skb, 12);
> +		skb_put_data(sub_skb, pdata, nSubframe_Length);
> +

Have you tested this?

thanks,

greg k-h