lkml.org 
[lkml]   [2012]   [Jan]   [10]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[16/20] asix: fix infinite loop in rx_fixup()
    2.6.32-longterm review patch.  If anyone has any objections, please let me know.

    ------------------
    From: Aurelien Jacobs <aurel@gnuage.org>

    commit 6c15d74defd38e7e7f8805392578b7a1d508097e upstream.

    At this point if skb->len happens to be 2, the subsequant skb_pull(skb, 4)
    call won't work and the skb->len won't be decreased and won't ever reach 0,
    resulting in an infinite loop.

    With an ASIX 88772 under heavy load, without this patch, rx_fixup() reaches
    an infinite loop in less than a minute. With this patch applied,
    no infinite loop even after hours of heavy load.

    Signed-off-by: Aurelien Jacobs <aurel@gnuage.org>
    Cc: Jussi Kivilinna <jussi.kivilinna@mbnet.fi>
    Signed-off-by: David S. Miller <davem@davemloft.net>

    ---
    drivers/net/usb/asix.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)
    --- a/drivers/net/usb/asix.c
    +++ b/drivers/net/usb/asix.c
    @@ -339,7 +339,7 @@ static int asix_rx_fixup(struct usbnet *

    skb_pull(skb, (size + 1) & 0xfffe);

    - if (skb->len == 0)
    + if (skb->len < sizeof(header))
    break;

    head = (u8 *) skb->data;



    \
     
     \ /
      Last update: 2012-01-10 21:15    [W:0.231 / U:0.792 seconds]
    ©2003-2014 Jasper Spaans. Advertise on this site