Re: [PATCH] rt2x00: fix memory corruption caused by eeprom buffer overflow

[Pavel Roskin <proski@gnu.org>]

On Mon, 2007-02-19 at 12:07 +0100, Ivo Van Doorn wrote:
> hi
> 
> > diff --git a/drivers/net/wireless/d80211/rt2x00/rt73usb.c b/drivers/net/wireless/d80211/rt2x00/rt73usb.c
> > index be66e2f..6fa5a7e 100644
> > --- a/drivers/net/wireless/d80211/rt2x00/rt73usb.c
> > +++ b/drivers/net/wireless/d80211/rt2x00/rt73usb.c
> > @@ -2705,7 +2705,7 @@ static int rt73usb_alloc_eeprom(struct rt2x00_dev *rt2x00dev)
> >          * Allocate the eeprom memory, check the eeprom width
> >          * and copy the entire eeprom into this allocated memory.
> >          */
> > -       rt2x00dev->eeprom = kzalloc(EEPROM_SIZE, GFP_KERNEL);
> > +       rt2x00dev->eeprom = kzalloc(EEPROM_SIZE, GFP_KERNEL * sizeof(u16));
> >         if (!rt2x00dev->eeprom)
> >                 return -ENOMEM;
> 
> you might want to change this to EEPROM_SIZE * sizeof(u16). ;)

Shame on me.  I wrote a patch that worked on rt61, and then I discarded
it to make a "clean" fix for all drivers.

But anyway, I'm seeing now that CVS on sourceforge.net is not abandoned,
so I think the best approach would be to integrate it into the kernel.
It would be great if you remove dead code from CVS, all those
"experimental" branches that haven't been touched for months if not
years.  It was hard for me to find the actual sources.  I would have
spent last Sunday evening doing something more interesting than fixing
fixed bugs :)

Finally, I'll appreciate if the driver is fixed to compile against
wireless-dev kernels.  You can take an approach similar to iwlwifi and
even rely on the same d80211 package.

-- 
Regards,
Pavel Roskin