]> git.baikalelectronics.ru Git - kernel.git/commit
rtl8xxxu: avoid parsing short RX packet
authorÍñigo Huguet <ihuguet@redhat.com>
Tue, 11 May 2021 07:19:27 +0000 (09:19 +0200)
committerKalle Valo <kvalo@codeaurora.org>
Sat, 19 Jun 2021 09:06:09 +0000 (12:06 +0300)
commitfc15679906a79cbc99f88a5fda75d2920c468a34
tree6227b31ef87c334be12ae84ed1100cf861d6e5fb
parent3204a1298106550a41f234d99692c3e67aeecf6e
rtl8xxxu: avoid parsing short RX packet

One USB data buffer can contain multiple received network
packets. If that's the case, they're processed this way:
1. Original buffer is cloned
2. Original buffer is trimmed to contain only the first
   network packet
3. This first network packet is passed to network stack
4. Cloned buffer is trimmed to eliminate the first network
   packet
5. Repeat with the cloned buffer until there are no more
   network packets inside

However, if the space remaining in original buffer after
the first network packet is not enough to contain at least
another network packet descriptor, it is not cloned.

The loop parsing this packets ended if remaining space == 0.
But if the remaining space was > 0 but < packet descriptor
size, another iteration of the loop was done, processing again
the previous packet because cloning didn't happen. Moreover,
the ownership of this packet had been passed to network
stack in the previous iteration.

This patch ensures that no extra iteration is done if the
remaining size is not enough for one packet, and also avoid
the first iteration for the same reason.

Probably this doesn't happen in practice, but can happen
theoretically.

Signed-off-by: Íñigo Huguet <ihuguet@redhat.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20210511071926.8951-1-ihuguet@redhat.com
drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c