rt2x00: Fix double usage of skb->cb in USB RX path.

Browse source

It is not safe to use the skb->cb area for both the rxd and
skb_frame_desc data at the same time, while they occupy an overlapping
piece of memory. This can lead to hard to trace crashes as pointers
within skb_frame_desc are pointing into nowhere, or the rxd data is
overwritten with non-sense.

Fix it by copying the rxd to a small buffer on the stack.

Signed-off-by: Gertjan van Wingerde <gwingerde@kpnplanet.nl>
Signed-off-by: Ivo van Doorn <IvDoorn@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

...

This commit is contained in:

Gertjan van Wingerde 2008-06-06 22:54:28 +02:00 • committed by John W. Linville

parent 239c249d06

commit a26cbc6508

3 changed files with 9 additions and 19 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

10

drivers/net/wireless/rt2x00/rt2500usb.c

View file

8

drivers/net/wireless/rt2x00/rt2x00usb.c

View file

10

drivers/net/wireless/rt2x00/rt73usb.c

View file