[PATCH v3 0/1] wifi: rtl8180: reject RX frames longer than MAX_RX_SIZE

[PATCH v3 0/1] wifi: rtl8180: reject RX frames longer than MAX_RX_SIZE

[Jiaxin Li]

Hi,

Thanks for the review and the suggestion on the variable ordering.
This v3 orders the new local variables in reverse Christmas tree style.

Regards,
Jiaxin Li 
School of Software
Taiyuan University of Technology

Jiaxin Li (1):
  wifi: rtl8180: reject RX frames longer than MAX_RX_SIZE

 drivers/net/wireless/realtek/rtl818x/rtl8180/dev.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)
--
2.34.1

[PATCH v3 1/1] wifi: rtl8180: reject RX frames longer than MAX_RX_SIZE

[Jiaxin Li]

rtl8180_handle_rx() passes the 12-bit length field from the RX
descriptor to skb_put() without clamping it to MAX_RX_SIZE.  The skb was
allocated with dev_alloc_skb(MAX_RX_SIZE), so a descriptor length above
MAX_RX_SIZE extends the skb past its allocated tailroom.

Store the reported length in a local variable and drop the frame before
allocating the replacement RX skb when it exceeds MAX_RX_SIZE.

Signed-off-by: Jiaxin Li <18135327133@163.com>
---
 drivers/net/wireless/realtek/rtl818x/rtl8180/dev.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/drivers/net/wireless/realtek/rtl818x/rtl8180/dev.c b/drivers/net/wireless/realtek/rtl818x/rtl8180/dev.c
index 4a5989172..d82d54112 100644
--- a/drivers/net/wireless/realtek/rtl818x/rtl8180/dev.c
+++ b/drivers/net/wireless/realtek/rtl818x/rtl8180/dev.c
@@ -255,7 +255,13 @@ static void rtl8180_handle_rx(struct ieee80211_hw *dev)
 			goto done;
 		else {
 			struct ieee80211_rx_status rx_status = {0};
-			struct sk_buff *new_skb = dev_alloc_skb(MAX_RX_SIZE);
+			u32 rx_len = flags & 0xFFF;
+			struct sk_buff *new_skb;
+
+			if (unlikely(rx_len > MAX_RX_SIZE))
+				goto done;
+
+			new_skb = dev_alloc_skb(MAX_RX_SIZE);
 
 			if (unlikely(!new_skb))
 				goto done;
@@ -274,7 +280,7 @@ static void rtl8180_handle_rx(struct ieee80211_hw *dev)
 			dma_unmap_single(&priv->pdev->dev,
 					 *((dma_addr_t *)skb->cb),
 					 MAX_RX_SIZE, DMA_FROM_DEVICE);
-			skb_put(skb, flags & 0xFFF);
+			skb_put(skb, rx_len);
 
 			rx_status.antenna = (flags2 >> 15) & 1;
 			rx_status.rate_idx = (flags >> 20) & 0xF;
-- 
2.34.1

RE: [PATCH v3 1/1] wifi: rtl8180: reject RX frames longer than MAX_RX_SIZE

[Ping-Ke Shih]

Jiaxin Li <18135327133@163.com> wrote:
> rtl8180_handle_rx() passes the 12-bit length field from the RX
> descriptor to skb_put() without clamping it to MAX_RX_SIZE.  The skb was
> allocated with dev_alloc_skb(MAX_RX_SIZE), so a descriptor length above
> MAX_RX_SIZE extends the skb past its allocated tailroom.
> 
> Store the reported length in a local variable and drop the frame before
> allocating the replacement RX skb when it exceeds MAX_RX_SIZE.
> 
> Signed-off-by: Jiaxin Li <18135327133@163.com>

Reviewed-by: Ping-Ke Shih <pkshih@realtek.com>