From: Greg KH <gregkh@suse.de>
To: linux-kernel@vger.kernel.org, stable@kernel.org
Cc: stable-review@kernel.org, torvalds@linux-foundation.org,
akpm@linux-foundation.org, alan@lxorguk.ukuu.org.uk,
"John W. Linville" <linville@tuxdriver.com>,
Larry Finger <Larry.Finger@lwfinger.net>
Subject: [34/71] b43: allocate receive buffers big enough for max frame len + offset
Date: Wed, 13 Apr 2011 09:09:57 -0700 [thread overview]
Message-ID: <20110413161046.078022774@clark.kroah.org> (raw)
In-Reply-To: <20110413161106.GA20405@kroah.com>
2.6.33-longterm review patch. If anyone has any objections, please let us know.
------------------
From: John W. Linville <linville@tuxdriver.com>
commit c85ce65ecac078ab1a1835c87c4a6319cf74660a upstream.
Otherwise, skb_put inside of dma_rx can fail...
https://bugzilla.kernel.org/show_bug.cgi?id=32042
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Acked-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/net/wireless/b43/dma.c | 2 +-
drivers/net/wireless/b43/dma.h | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/net/wireless/b43/dma.c
+++ b/drivers/net/wireless/b43/dma.c
@@ -1554,7 +1554,7 @@ static void dma_rx(struct b43_dmaring *r
dmaaddr = meta->dmaaddr;
goto drop_recycle_buffer;
}
- if (unlikely(len > ring->rx_buffersize)) {
+ if (unlikely(len + ring->frameoffset > ring->rx_buffersize)) {
/* The data did not fit into one descriptor buffer
* and is split over multiple buffers.
* This should never happen, as we try to allocate buffers
--- a/drivers/net/wireless/b43/dma.h
+++ b/drivers/net/wireless/b43/dma.h
@@ -163,7 +163,7 @@ struct b43_dmadesc_generic {
/* DMA engine tuning knobs */
#define B43_TXRING_SLOTS 256
#define B43_RXRING_SLOTS 64
-#define B43_DMA0_RX_BUFFERSIZE IEEE80211_MAX_FRAME_LEN
+#define B43_DMA0_RX_BUFFERSIZE (B43_DMA0_RX_FRAMEOFFSET + IEEE80211_MAX_FRAME_LEN)
/* Pointer poison */
#define B43_DMA_PTR_POISON ((void *)ERR_PTR(-ENOMEM))
next prev parent reply other threads:[~2011-04-13 16:13 UTC|newest]
Thread overview: 73+ messages / expand[flat|nested] mbox.gz Atom feed top
2011-04-13 16:11 [00/71] 2.6.33.10-longterm review Greg KH
2011-04-13 16:09 ` [01/71] ALSA: HDA: New AD1984A model for Dell Precision R5500 Greg KH
2011-04-13 16:09 ` [02/71] ALSA: hda - Fix SPDIF out regression on ALC889 Greg KH
2011-04-13 16:09 ` [03/71] ALSA: Fix yet another race in disconnection Greg KH
2011-04-13 16:09 ` [04/71] perf: Better fit max unprivileged mlock pages for tools needs Greg KH
2011-04-13 16:09 ` [05/71] myri10ge: fix rmmod crash Greg KH
2011-04-13 16:09 ` [06/71] cciss: fix lost command issue Greg KH
2011-04-13 16:09 ` [07/71] sound/oss/opl3: validate voice and channel indexes Greg KH
2011-04-13 16:09 ` [08/71] mac80211: initialize sta->last_rx in sta_info_alloc Greg KH
2011-04-13 16:09 ` [09/71] [SCSI] ses: show devices for enclosures with no page 7 Greg KH
2011-04-13 16:09 ` [10/71] [SCSI] ses: Avoid kernel panic when lun 0 is not mapped Greg KH
2011-04-13 16:09 ` [11/71] eCryptfs: Unlock page in write_begin error path Greg KH
2011-04-13 16:09 ` [12/71] eCryptfs: ecryptfs_keyring_auth_tok_for_sig() bug fix Greg KH
2011-04-13 16:09 ` [13/71] staging: usbip: bugfixes related to kthread conversion Greg KH
2011-04-13 16:09 ` [14/71] staging: usbip: bugfix add number of packets for isochronous frames Greg KH
2011-04-13 16:09 ` [15/71] staging: usbip: bugfix for isochronous packets and optimization Greg KH
2011-04-13 16:09 ` [16/71] staging: hv: use sync_bitops when interacting with the hypervisor Greg KH
2011-04-13 16:09 ` [17/71] Relax si_code check in rt_sigqueueinfo and rt_tgsigqueueinfo Greg KH
2011-04-13 16:09 ` [18/71] xfs: prevent leaking uninitialized stack memory in FSGEOMETRY_V1 Greg KH
2011-04-14 3:50 ` [Stable-review] " Ben Hutchings
2011-04-13 16:09 ` [19/71] irda: validate peer name and attribute lengths Greg KH
2011-04-13 16:09 ` [20/71] irda: prevent heap corruption on invalid nickname Greg KH
2011-04-13 16:09 ` [21/71] nilfs2: fix data loss in mmap page write for hole blocks Greg KH
2011-04-13 16:09 ` [22/71] ASoC: Explicitly say registerless widgets have no register Greg KH
2011-04-13 16:09 ` [23/71] ALSA: ens1371: fix Creative Ectiva support Greg KH
2011-04-13 16:09 ` [24/71] ROSE: prevent heap corruption with bad facilities Greg KH
2011-04-13 16:09 ` [25/71] Btrfs: Fix uninitialized root flags for subvolumes Greg KH
2011-04-13 16:09 ` [26/71] x86, mtrr, pat: Fix one cpu getting out of sync during resume Greg KH
2011-04-13 16:09 ` [27/71] ath9k: fix a chip wakeup related crash in ath9k_start Greg KH
2011-04-13 16:09 ` [28/71] UBIFS: do not read flash unnecessarily Greg KH
2011-04-13 16:09 ` [29/71] UBIFS: fix oops on error path in read_pnode Greg KH
2011-04-13 16:09 ` [30/71] UBIFS: fix debugging failure in dbg_check_space_info Greg KH
2011-04-13 16:09 ` [31/71] quota: Dont write quota info in dquot_commit() Greg KH
2011-04-13 16:09 ` [32/71] mm: avoid wrapping vm_pgoff in mremap() Greg KH
2011-04-13 16:09 ` [33/71] p54usb: IDs for two new devices Greg KH
2011-04-13 16:09 ` Greg KH [this message]
2011-04-13 16:09 ` [35/71] Bluetooth: sco: fix information leak to userspace Greg KH
2011-04-13 16:09 ` [36/71] bridge: netfilter: fix information leak Greg KH
2011-04-13 16:10 ` [37/71] Bluetooth: bnep: fix buffer overflow Greg KH
2011-04-13 16:10 ` [38/71] Bluetooth: add support for Apple MacBook Pro 8,2 Greg KH
2011-04-13 16:10 ` [39/71] Treat writes as new when holes span across page boundaries Greg KH
2011-04-13 16:10 ` [40/71] char/tpm: Fix unitialized usage of data buffer Greg KH
2011-04-13 16:10 ` [41/71] netfilter: ip_tables: fix infoleak to userspace Greg KH
2011-04-13 16:10 ` [42/71] netfilter: arp_tables: " Greg KH
2011-04-13 16:10 ` [43/71] netfilter: ipt_CLUSTERIP: fix buffer overflow Greg KH
2011-04-13 16:10 ` [44/71] ipv6: netfilter: ip6_tables: fix infoleak to userspace Greg KH
2011-04-13 16:10 ` [45/71] mfd: ab3100: world-writable debugfs *_priv files Greg KH
2011-04-13 16:10 ` [46/71] drivers/rtc/rtc-ds1511.c: world-writable sysfs nvram file Greg KH
2011-04-13 16:10 ` [47/71] drivers/misc/ep93xx_pwm.c: world-writable sysfs files Greg KH
2011-04-13 16:10 ` [48/71] econet: 4 byte infoleak to the network Greg KH
2011-04-13 16:10 ` [49/71] netfilter: h323: bug in parsing of ASN1 SEQOF field Greg KH
2011-04-13 16:10 ` [50/71] sound/oss: remove offset from load_patch callbacks Greg KH
2011-04-13 16:10 ` [51/71] sound: oss: midi_synth: check get_user() return value Greg KH
2011-04-13 16:10 ` [52/71] repair gdbstub to match the gdbserial protocol specification Greg KH
2011-04-13 16:10 ` [53/71] gro: Reset dev pointer on reuse Greg KH
2011-04-13 16:10 ` [54/71] gro: reset skb_iif " Greg KH
2011-04-13 16:10 ` [55/71] powerpc/kexec: Add ifdef CONFIG_PPC_STD_MMU_64 to PPC64 code Greg KH
2011-04-13 16:10 ` [56/71] powerpc: Fix default_machine_crash_shutdown #ifdef botch Greg KH
2011-04-13 16:10 ` [57/71] [PATCH] Revert "x86: Cleanup highmap after brk is concluded" Greg KH
2011-04-13 16:10 ` [58/71] Squashfs: handle corruption of directory structure Greg KH
2011-04-13 16:10 ` [59/71] atm/solos-pci: Dont include frame pseudo-header on transmit hex-dump Greg KH
2011-04-13 16:10 ` [60/71] net: ax25: fix information leak to userland Greg KH
2011-04-13 16:10 ` [61/71] net: packet: " Greg KH
2011-04-13 16:10 ` [62/71] ext4: fix credits computing for indirect mapped files Greg KH
2011-04-13 16:10 ` [63/71] nfsd: fix auth_domain reference leak on nlm operations Greg KH
2011-04-13 16:10 ` [64/71] net: tipc: fix information leak to userland Greg KH
2011-04-13 16:10 ` [65/71] inet_diag: Make sure we actually run the same bytecode we audited Greg KH
2011-04-13 16:10 ` [66/71] econet: Fix crash in aun_incoming() Greg KH
2011-04-13 16:10 ` [67/71] irda: prevent integer underflow in IRLMP_ENUMDEVICES Greg KH
2011-04-13 16:10 ` [68/71] CAN: Use inode instead of kernel address for /proc file Greg KH
2011-04-13 16:10 ` [69/71] exec: make argv/envp memory visible to oom-killer Greg KH
2011-04-13 16:10 ` [70/71] exec: copy-and-paste the fixes into compat_do_execve() paths Greg KH
2011-04-13 16:10 ` [71/71] net: fix rds_iovec page count overflow Greg KH
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20110413161046.078022774@clark.kroah.org \
--to=gregkh@suse.de \
--cc=Larry.Finger@lwfinger.net \
--cc=akpm@linux-foundation.org \
--cc=alan@lxorguk.ukuu.org.uk \
--cc=linux-kernel@vger.kernel.org \
--cc=linville@tuxdriver.com \
--cc=stable-review@kernel.org \
--cc=stable@kernel.org \
--cc=torvalds@linux-foundation.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®