xiaomi-sm8450/android_kernel_xiaomi_sm8450
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

rt2x00: Properly reserve room for descriptors in skbs.

Browse Source 
Instead of fiddling with the skb->data pointer and thereby risking
out of bounds accesses, properly reserve the space needed in an
skb for descriptors.

Signed-off-by: Gertjan van Wingerde <gwingerde@gmail.com>
Acked-by: Ivo van Doorn <IvDoorn@gmail.com>
Signed-off-by: Ivo van Doorn <IvDoorn@gmail.com>
This commit is contained in:
Gertjan van Wingerde
2010-06-03 10:51:45 +02:00
committed by Ivo van Doorn
parent baaffe67b5
commit 0b8004aa12
16 changed files with 109 additions and 79 deletions
Download Patch File Download Diff File Expand all files Collapse all files

40
drivers/net/wireless/rt2x00/rt2x00pci.c
View File

@@ -81,12 +81,24 @@ int rt2x00pci_write_tx_data(struct queue_entry *entry,
return -EINVAL;
}
/*
* Add the requested extra tx headroom in front of the skb.
*/
skb_push(entry->skb, rt2x00dev->ops->extra_tx_headroom);
memset(entry->skb->data, 0, rt2x00dev->ops->extra_tx_headroom);
/*
* Call the driver's write_tx_datadesc function, if it exists.
*/
if (rt2x00dev->ops->lib->write_tx_datadesc)
rt2x00dev->ops->lib->write_tx_datadesc(entry, txdesc);
/*
* Map the skb to DMA.
*/
if (test_bit(DRIVER_REQUIRE_DMA, &rt2x00dev->flags))
rt2x00queue_map_txskb(rt2x00dev, entry->skb);
return 0;
}
EXPORT_SYMBOL_GPL(rt2x00pci_write_tx_data);
@@ -94,6 +106,34 @@ EXPORT_SYMBOL_GPL(rt2x00pci_write_tx_data);
/*
* TX/RX data handlers.
*/
void rt2x00pci_txdone(struct queue_entry *entry,
struct txdone_entry_desc *txdesc)
{
struct rt2x00_dev *rt2x00dev = entry->queue->rt2x00dev;
struct skb_frame_desc *skbdesc = get_skb_frame_desc(entry->skb);
/*
* Unmap the skb.
*/
rt2x00queue_unmap_skb(rt2x00dev, entry->skb);
/*
* Remove the extra tx headroom from the skb.
*/
skb_pull(entry->skb, rt2x00dev->ops->extra_tx_headroom);
/*
* Signal that the TX descriptor is no longer in the skb.
*/
skbdesc->flags &= ~SKBDESC_DESC_IN_SKB;
/*
* Pass on to rt2x00lib.
*/
rt2x00lib_txdone(entry, txdesc);
}
EXPORT_SYMBOL_GPL(rt2x00pci_txdone);
void rt2x00pci_rxdone(struct rt2x00_dev *rt2x00dev)
{
struct data_queue *queue = rt2x00dev->rx;