netdev - [PATCH 02/13] staging: wfx: check the vif ID of the Tx confirmations

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20200701150707.222985-3-Jerome.Pouiller@silabs.com>
Date:   Wed,  1 Jul 2020 17:06:56 +0200
From:   Jerome Pouiller <Jerome.Pouiller@...abs.com>
To:     devel@...verdev.osuosl.org, linux-wireless@...r.kernel.org
Cc:     netdev@...r.kernel.org, linux-kernel@...r.kernel.org,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        Kalle Valo <kvalo@...eaurora.org>,
        "David S . Miller" <davem@...emloft.net>,
        Jérôme Pouiller 
        <jerome.pouiller@...abs.com>
Subject: [PATCH 02/13] staging: wfx: check the vif ID of the Tx confirmations

From: Jérôme Pouiller <jerome.pouiller@...abs.com>

When the driver has sent a frame on a virtual interface (vif), it
expects to receive the confirmation on the same vif.

This patch add a check for that.

Signed-off-by: Jérôme Pouiller <jerome.pouiller@...abs.com>
---
 drivers/staging/wfx/queue.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/staging/wfx/queue.c b/drivers/staging/wfx/queue.c
index 7ec36598d9a83..6069143369f30 100644
--- a/drivers/staging/wfx/queue.c
+++ b/drivers/staging/wfx/queue.c
@@ -142,14 +142,18 @@ struct sk_buff *wfx_pending_get(struct wfx_vif *wvif, u32 packet_id)
 {
 	struct wfx_queue *queue;
 	struct hif_req_tx *req;
+	struct hif_msg *hif;
 	struct sk_buff *skb;
 
 	spin_lock_bh(&wvif->wdev->tx_pending.lock);
 	skb_queue_walk(&wvif->wdev->tx_pending, skb) {
-		req = wfx_skb_txreq(skb);
+		hif = (struct hif_msg *)skb->data;
+		req = (struct hif_req_tx *)hif->body;
 		if (req->packet_id == packet_id) {
 			spin_unlock_bh(&wvif->wdev->tx_pending.lock);
 			queue = &wvif->tx_queue[skb_get_queue_mapping(skb)];
+			WARN(hif->interface != wvif->id, "sent frame %08x on vif %d, but get reply on vif %d",
+			     req->packet_id, hif->interface, wvif->id);
 			WARN_ON(skb_get_queue_mapping(skb) > 3);
 			WARN_ON(!atomic_read(&queue->pending_frames));
 			atomic_dec(&queue->pending_frames);
-- 
2.27.0