Commit ea2e77c8 authored by Duncan Sands's avatar Duncan Sands Committed by Greg Kroah-Hartman

[PATCH] USB speedtouch: discard packets for non-existant vcc's

I broke part of the udsl_decode_rawcell logic in a previous patch, leading to
possible hangs on startup/shutdown.  I've attached the 2.4 and 2.5 versions.
Thanks to Subodh Srivastava and Ted Phelps for their bug reports.  Here is the
2.5 patch included inline for reference:
parent 4d2aecef
...@@ -278,9 +278,10 @@ static struct sk_buff *udsl_decode_rawcell (struct udsl_instance_data *instance, ...@@ -278,9 +278,10 @@ static struct sk_buff *udsl_decode_rawcell (struct udsl_instance_data *instance,
/* here should the header CRC check be... */ /* here should the header CRC check be... */
if (!(vcc = udsl_find_vcc (instance, vpi, vci))) if (!(vcc = udsl_find_vcc (instance, vpi, vci))) {
dbg ("udsl_decode_rawcell: no vcc found for packet on vpi %d, vci %d", vpi, vci); dbg ("udsl_decode_rawcell: no vcc found for packet on vpi %d, vci %d", vpi, vci);
else { __skb_pull (skb, min (skb->len, (unsigned) 53));
} else {
dbg ("udsl_decode_rawcell found vcc %p for packet on vpi %d, vci %d", vcc, vpi, vci); dbg ("udsl_decode_rawcell found vcc %p for packet on vpi %d, vci %d", vcc, vpi, vci);
if (skb->len >= 53) { if (skb->len >= 53) {
...@@ -323,8 +324,8 @@ static struct sk_buff *udsl_decode_rawcell (struct udsl_instance_data *instance, ...@@ -323,8 +324,8 @@ static struct sk_buff *udsl_decode_rawcell (struct udsl_instance_data *instance,
skb_pull (skb, 53); skb_pull (skb, 53);
} else { } else {
/* If data is corrupt and skb doesn't hold a whole cell, flush the lot */ /* If data is corrupt and skb doesn't hold a whole cell, flush the lot */
if (skb_pull (skb, 53) == NULL) __skb_pull (skb, skb->len);
return NULL; return NULL;
} }
} }
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment