From patchwork Mon Feb 27 21:56:33 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ben Greear X-Patchwork-Id: 9594665 X-Patchwork-Delegate: johannes@sipsolutions.net Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 9358860453 for ; Tue, 28 Feb 2017 04:32:39 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 9137128500 for ; Tue, 28 Feb 2017 04:32:39 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 84C2228512; Tue, 28 Feb 2017 04:32:39 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=2.0 tests=BAYES_00,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 380BE2850D for ; Tue, 28 Feb 2017 04:32:38 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751341AbdB1Ecf (ORCPT ); Mon, 27 Feb 2017 23:32:35 -0500 Received: from mail2.candelatech.com ([208.74.158.173]:37270 "EHLO mail2.candelatech.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751344AbdB1Ece (ORCPT ); Mon, 27 Feb 2017 23:32:34 -0500 Received: from ben-dt3.candelatech.com (firewall.candelatech.com [50.251.239.81]) by mail2.candelatech.com (Postfix) with ESMTP id 4A04240A5ED; Mon, 27 Feb 2017 13:56:39 -0800 (PST) From: greearb@candelatech.com To: linux-wireless@vger.kernel.org Cc: Ben Greear Subject: [PATCH v2 4/4] mac80211-hwsim: add length checks before allocating skb. Date: Mon, 27 Feb 2017 13:56:33 -0800 Message-Id: <1488232593-2552-4-git-send-email-greearb@candelatech.com> X-Mailer: git-send-email 2.4.11 In-Reply-To: <1488232593-2552-1-git-send-email-greearb@candelatech.com> References: <1488232593-2552-1-git-send-email-greearb@candelatech.com> Sender: linux-wireless-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-wireless@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP From: Ben Greear Modify the receive-from-user-space logic to do length and 'is-down' checks before trying to allocate an skb. And, if we are going to ignore the pkt due to radio idle, then do not return an error code to user-space. User-space cannot reliably know exactly when a radio is idle or not. Signed-off-by: Ben Greear --- v2: Don't return success when radio is idle, but do return unique error code (ENETDOWN) in hopes user-space can make a distinction. drivers/net/wireless/mac80211_hwsim.c | 41 +++++++++++++++++++---------------- 1 file changed, 22 insertions(+), 19 deletions(-) diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c index c259b99..73dc627 100644 --- a/drivers/net/wireless/mac80211_hwsim.c +++ b/drivers/net/wireless/mac80211_hwsim.c @@ -3020,6 +3020,7 @@ static int hwsim_cloned_frame_received_nl(struct sk_buff *skb_2, int frame_data_len; void *frame_data; struct sk_buff *skb = NULL; + int rv = -EINVAL; if (!info->attrs[HWSIM_ATTR_ADDR_RECEIVER] || !info->attrs[HWSIM_ATTR_FRAME] || @@ -3034,25 +3035,6 @@ static int hwsim_cloned_frame_received_nl(struct sk_buff *skb_2, frame_data_len = nla_len(info->attrs[HWSIM_ATTR_FRAME]); frame_data = (void *)nla_data(info->attrs[HWSIM_ATTR_FRAME]); - /* Allocate new skb here */ - skb = alloc_skb(frame_data_len, GFP_KERNEL); - if (skb == NULL) { - if (hwsim_ratelimit()) - printk(KERN_DEBUG " hwsim rx-nl: skb alloc failed, len: %d\n", - frame_data_len); - goto out; - } - - if (frame_data_len > IEEE80211_MAX_DATA_LEN) { - if (hwsim_ratelimit()) - printk(KERN_DEBUG " hwsim rx-nl: data lenth error: %d max: %d\n", - frame_data_len, IEEE80211_MAX_DATA_LEN); - goto out; - } - - /* Copy the data */ - memcpy(skb_put(skb, frame_data_len), frame_data, frame_data_len); - data2 = get_hwsim_data_ref_from_addr(dst); if (!data2) { @@ -3081,9 +3063,30 @@ static int hwsim_cloned_frame_received_nl(struct sk_buff *skb_2, if (((cnt++ & 0x3FF) == 0x3FF) && hwsim_ratelimit()) printk(KERN_DEBUG " hwsim rx-nl: radio %pM idle: %d or not started: %d cnt: %d\n", dst, data2->idle, !data2->started, cnt); + rv = -ENETDOWN; goto out; } + if (frame_data_len > IEEE80211_MAX_DATA_LEN) { + if (hwsim_ratelimit()) + printk(KERN_DEBUG " hwsim rx-nl: data lenth error: %d max: %d\n", + frame_data_len, IEEE80211_MAX_DATA_LEN); + goto out; + } + + + /* Allocate new skb here */ + skb = alloc_skb(frame_data_len, GFP_KERNEL); + if (skb == NULL) { + if (hwsim_ratelimit()) + printk(KERN_DEBUG " hwsim rx-nl: skb alloc failed, len: %d\n", + frame_data_len); + goto out; + } + + /* Copy the data */ + memcpy(skb_put(skb, frame_data_len), frame_data, frame_data_len); + /* A frame is received from user space */ memset(&rx_status, 0, sizeof(rx_status)); if (info->attrs[HWSIM_ATTR_FREQ]) {