| Message ID | 1443644404-6452-1-git-send-email-linux@davidrobins.net |
|---|---|
| State | Accepted, archived |
| Delegated to: | David Miller |
| Headers | show |
From: "David B. Robins" <linux@davidrobins.net> Date: Wed, 30 Sep 2015 16:20:04 -0400 > If asix_rx_fixup_internal() fails to allocate rx->ax_skb, it will return > but not clear rx->size. rx points to driver private data. A later call > assumes that nonzero size means ax_skb was allocated and passes a null > ax_skb to skb_put. Changed allocation failure return to clear size first. > > Found testing board with AX88772B devices. > > Signed-off-by: David B. Robins <linux@davidrobins.net> Applied, thanks. -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
On 2015-10-05 06:31, David Miller wrote: > From: "David B. Robins" <linux@davidrobins.net> > Date: Wed, 30 Sep 2015 16:20:04 -0400 > >> If asix_rx_fixup_internal() fails to allocate rx->ax_skb, it will >> return >> but not clear rx->size. rx points to driver private data. A later call >> assumes that nonzero size means ax_skb was allocated and passes a null >> ax_skb to skb_put. Changed allocation failure return to clear size >> first. >> >> Found testing board with AX88772B devices. >> >> Signed-off-by: David B. Robins <linux@davidrobins.net> > > Applied, thanks. While I am happy for the patch I submitted to be applied, and it is consistent with existing error handling and does fix the specific issue, I believe a later series of 5 patches by Dean Jenkins that more comprehensively address the issue (grouped under subject "Improve ASIX RX memory allocation error handling") should be preferred. -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/drivers/net/usb/asix_common.c b/drivers/net/usb/asix_common.c index 75d6f26..079069a 100644 --- a/drivers/net/usb/asix_common.c +++ b/drivers/net/usb/asix_common.c @@ -91,8 +91,10 @@ int asix_rx_fixup_internal(struct usbnet *dev, struct sk_buff *skb, } rx->ax_skb = netdev_alloc_skb_ip_align(dev->net, rx->size); - if (!rx->ax_skb) + if (!rx->ax_skb) { + rx->size = 0; return 0; + } } if (rx->size > dev->net->mtu + ETH_HLEN + VLAN_HLEN) {
If asix_rx_fixup_internal() fails to allocate rx->ax_skb, it will return but not clear rx->size. rx points to driver private data. A later call assumes that nonzero size means ax_skb was allocated and passes a null ax_skb to skb_put. Changed allocation failure return to clear size first. Found testing board with AX88772B devices. Signed-off-by: David B. Robins <linux@davidrobins.net> --- drivers/net/usb/asix_common.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)