diff options
| author | Felix Fietkau <nbd@nbd.name> | 2017-02-24 11:57:27 +0100 |
|---|---|---|
| committer | Felix Fietkau <nbd@nbd.name> | 2017-02-24 12:22:29 +0100 |
| commit | 703515f889124248480f39d65f8704548cbf1c09 (patch) | |
| tree | cd06f11ec2cc4e6ddb75c8982ecaab9882d3a9ed /package/kernel/mac80211/patches/650-0001-rtl8xxxu-Fix-memory-leak-in-handling-rxdesc16-packet.patch | |
| parent | d27dd6298b0f9a66199758b32ce19c0932ef2ee0 (diff) | |
| download | mtk-20170518-703515f889124248480f39d65f8704548cbf1c09.zip mtk-20170518-703515f889124248480f39d65f8704548cbf1c09.tar.gz mtk-20170518-703515f889124248480f39d65f8704548cbf1c09.tar.bz2 | |
mac80211: sync with master branch as of 9edff13abd97
Includes the following changes:
9edff13abd mac80211: disable potentially harmful PS software retry for A-MPDU sessions
75216a76b0 mac80211: backport upstream fix for CSA in IBSS mode
368cc8ef47 mac80211: update brcmfmac backporting brcmf_err cleanups
66a63d25c4 mac80211: fix build on linux 3.18
9eacb9d7fc rt2x00: mt7620: lots of improvements
fd94fa61a7 mac80211: brcmfmac: update Raspberry Pi patches for linux 4.9
649e766a64 mac80211: update to wireless-testing 2017-01-31
47540afa5d ath9k: add a warning to the tx99 config option
b367eef21d mac80211: rt2x00: add support for external LNA on MT7620
9200e168f2 mac80211: move (& update) upstream accepted brcmfmac patches
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Diffstat (limited to 'package/kernel/mac80211/patches/650-0001-rtl8xxxu-Fix-memory-leak-in-handling-rxdesc16-packet.patch')
| -rw-r--r-- | package/kernel/mac80211/patches/650-0001-rtl8xxxu-Fix-memory-leak-in-handling-rxdesc16-packet.patch | 34 |
1 files changed, 0 insertions, 34 deletions
diff --git a/package/kernel/mac80211/patches/650-0001-rtl8xxxu-Fix-memory-leak-in-handling-rxdesc16-packet.patch b/package/kernel/mac80211/patches/650-0001-rtl8xxxu-Fix-memory-leak-in-handling-rxdesc16-packet.patch deleted file mode 100644 index 31604b6..0000000 --- a/package/kernel/mac80211/patches/650-0001-rtl8xxxu-Fix-memory-leak-in-handling-rxdesc16-packet.patch +++ /dev/null @@ -1,34 +0,0 @@ -From 51be39337a10a8bf9d8ec65419e78b76bf5adf60 Mon Sep 17 00:00:00 2001 -From: Jes Sorensen <Jes.Sorensen@redhat.com> -Date: Wed, 28 Sep 2016 14:48:51 -0400 -Subject: [PATCH] rtl8xxxu: Fix memory leak in handling rxdesc16 packets - -A device running without RX package aggregation could return more data -in the USB packet than the actual network packet. In this case the -could would clone the skb but then determine that that there was no -packet to handle and exit without freeing the cloned skb first. - -This has so far only been observed with 8188eu devices, but could -affect others. - -Signed-off-by: Jes Sorensen <Jes.Sorensen@redhat.com> ---- - drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c | 7 ++++++- - 1 file changed, 6 insertions(+), 1 deletion(-) - ---- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c -+++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c -@@ -5197,7 +5197,12 @@ int rtl8xxxu_parse_rxdesc16(struct rtl8x - pkt_offset = roundup(pkt_len + drvinfo_sz + desc_shift + - sizeof(struct rtl8xxxu_rxdesc16), 128); - -- if (pkt_cnt > 1) -+ /* -+ * Only clone the skb if there's enough data at the end to -+ * at least cover the rx descriptor -+ */ -+ if (pkt_cnt > 1 && -+ urb_len > (pkt_offset + sizeof(struct rtl8xxxu_rxdesc16))) - next_skb = skb_clone(skb, GFP_ATOMIC); - - rx_status = IEEE80211_SKB_RXCB(skb); |