[2.6 patch] drivers/net/wireless/libertas/rx.c: fix use-after-free

[2.6 patch] drivers/net/wireless/libertas/rx.c: fix use-after-free

[Eugene Teo]

libertas_upload_rx_packet() calls netif_rx() before returning, and it always return 0.
Also within libertas_upload_rx_packet(), it will initialize skb->protocol anyways.

Spotted by the Coverity checker.

Signed-off-by: Eugene Teo <eteo@redhat.com>

diff --git a/drivers/net/wireless/libertas/rx.c b/drivers/net/wireless/libertas/rx.c
index d17924f..1d8d5e4 100644
--- a/drivers/net/wireless/libertas/rx.c
+++ b/drivers/net/wireless/libertas/rx.c
@@ -269,15 +269,12 @@ int libertas_process_rxed_packet(wlan_private * priv, struct sk_buff *skb)
        wlan_compute_rssi(priv, p_rx_pd);

        lbs_pr_debug(1, "RX Data: size of actual packet = %d\n", skb->len);
-       if (libertas_upload_rx_packet(priv, skb)) {
-               lbs_pr_debug(1, "RX error: libertas_upload_rx_packet"
-                      " returns failure\n");
-               ret = -1;
-               goto done;
-       }
+
        priv->stats.rx_bytes += skb->len;
        priv->stats.rx_packets++;

+       libertas_upload_rx_packet(priv, skb);
+
        ret = 0;
 done:
        LEAVE();
@@ -439,21 +436,14 @@ static int process_rxed_802_11_packet(wlan_private * priv, struct
sk_buff *skb)

        lbs_pr_debug(1, "RX Data: size of actual packet = %d\n", skb->len);

-       if (libertas_upload_rx_packet(priv, skb)) {
-               lbs_pr_debug(1, "RX error: libertas_upload_rx_packet "
-                       "returns failure\n");
-               ret = -1;
-               goto done;
-       }
-
        priv->stats.rx_bytes += skb->len;
        priv->stats.rx_packets++;

+       libertas_upload_rx_packet(priv, skb);
+
        ret = 0;
 done:
        LEAVE();

-       skb->protocol = __constant_htons(0x0019);       /* ETH_P_80211_RAW */
-

Re: [2.6 patch] drivers/net/wireless/libertas/rx.c: fix use-after-free

[John W. Linville]

First, please send all wireless patches to
linux-wireless@vger.kernel.org, and be sure to CC me as well...thanks!

On Sat, May 19, 2007 at 12:50:31AM +0800, Eugene Teo wrote:
> libertas_upload_rx_packet() calls netif_rx() before returning, and it always return 0.
> Also within libertas_upload_rx_packet(), it will initialize skb->protocol anyways.
> 
> Spotted by the Coverity checker.

A nearly identical patch was posted by Florin Malita <fmalita@gmail.com>
to netdev (also the wrong list) on Wednesday evening.

>  done:
>         LEAVE();
> 
> -       skb->protocol = __constant_htons(0x0019);       /* ETH_P_80211_RAW */
> -

Except for this part...is this intentional?

John
-- 
John W. Linville
linville@tuxdriver.com

Re: [2.6 patch] drivers/net/wireless/libertas/rx.c: fix use-after-free

[Eugene Teo]

John W. Linville wrote:
> First, please send all wireless patches to
> linux-wireless@vger.kernel.org, and be sure to CC me as well...thanks!
> 
> On Sat, May 19, 2007 at 12:50:31AM +0800, Eugene Teo wrote:
>> libertas_upload_rx_packet() calls netif_rx() before returning, and it always return 0.
>> Also within libertas_upload_rx_packet(), it will initialize skb->protocol anyways.
>>
>> Spotted by the Coverity checker.
> 
> A nearly identical patch was posted by Florin Malita <fmalita@gmail.com>
> to netdev (also the wrong list) on Wednesday evening.

Nod. I wasn't subscribed to netdev list.

>>  done:
>>         LEAVE();
>>
>> -       skb->protocol = __constant_htons(0x0019);       /* ETH_P_80211_RAW */
>> -
> 
> Except for this part...is this intentional?

skb could have been freed by then. And, in libertas_upload_rx_packet(), skb->protocol
is initialized by eth_type_trans(skb, priv->wlan_dev.netdev).

Eugene

Re: [2.6 patch] drivers/net/wireless/libertas/rx.c: fix use-after-free

[John W. Linville]

On Sat, May 19, 2007 at 11:14:10AM +0800, Eugene Teo wrote:
> John W. Linville wrote:

> >>  done:
> >>         LEAVE();
> >>
> >> -       skb->protocol = __constant_htons(0x0019);       /* ETH_P_80211_RAW */
> >> -
> > 
> > Except for this part...is this intentional?
> 
> skb could have been freed by then. And, in libertas_upload_rx_packet(), skb->protocol
> is initialized by eth_type_trans(skb, priv->wlan_dev.netdev).

OK, I see that.  Looks like Florin has reposted his patch, still
without this hunk.  Would you like to submit a patch for this hunk?

Thanks,

John
-- 
John W. Linville
linville@tuxdriver.com

Re: [2.6 patch] drivers/net/wireless/libertas/rx.c: fix use-after-free

[Eugene Teo]

<quote sender="John W. Linville">
> On Sat, May 19, 2007 at 11:14:10AM +0800, Eugene Teo wrote:
> > John W. Linville wrote:
> 
> > >>  done:
> > >>         LEAVE();
> > >>
> > >> -       skb->protocol = __constant_htons(0x0019);       /* ETH_P_80211_RAW */
> > >> -
> > > 
> > > Except for this part...is this intentional?
> > 
> > skb could have been freed by then. And, in libertas_upload_rx_packet(), skb->protocol
> > is initialized by eth_type_trans(skb, priv->wlan_dev.netdev).
> 
> OK, I see that.  Looks like Florin has reposted his patch, still
> without this hunk.  Would you like to submit a patch for this hunk?

skb could have been freed by then. Also, in libertas_upload_rx_packet(),
skb->protocol is initialized by eth_type_trans().

Cc: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Eugene Teo <eugeneteo@kernel.sg>
---

diff -uprN -X 2.6.22-rc2/Documentation/dontdiff 2.6.22-rc2.default/drivers/net/wireless/libertas/rx.c 2.6.22-rc2/drivers/net/wireless/libertas/rx.c
--- 2.6.22-rc2.default/drivers/net/wireless/libertas/rx.c	2007-05-21 22:07:50.000000000 +0800
+++ 2.6.22-rc2/drivers/net/wireless/libertas/rx.c	2007-05-21 22:08:44.000000000 +0800
@@ -453,7 +453,5 @@ static int process_rxed_802_11_packet(wl
 done:
 	LEAVE();
 
-	skb->protocol = __constant_htons(0x0019);	/* ETH_P_80211_RAW */
-
 	return (ret);
 }

-- 
1024D/58DF8823 print 47B9 90F6 AE4A 9C51 37E0  D6E1 EA84 C6A2 58DF 8823
main(i) { putchar(182623909 >> (i-1) * 5&31|!!(i<7)<<6) && main(++i); }