[IrDA]: Frame length validation.

When using a stir4200-based USB adaptor to talk to a device that uses
an mcp2150, the stir4200 sometimes drops an incoming frame causing the
mcp2150 to try and retransmit the lost frame. In this combination, the
next frame received from the mcp2150 is often invalid - either an
empty i:rsp or an IrCOMM i:rsp with an invalid clen. These corner
cases are now checked.

Signed-off-by: Robie Basak <rb-oss-1@justgohome.co.uk>
Signed-off-by: Samuel Ortiz <samuel@sortiz.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/net/irda/ircomm/ircomm_core.c b/net/irda/ircomm/ircomm_core.c
index 2d63fa8e155641f1bf4937ee0c733041f97000e5..b825399fc16002dc98a3983c8475462286072afc 100644 (file)
--- a/net/irda/ircomm/ircomm_core.c
+++ b/net/irda/ircomm/ircomm_core.c
@@ -362,6 +362,18 @@ void ircomm_process_data(struct ircomm_cb *self, struct sk_buff *skb)
 
        clen = skb->data[0];
 
+       /*
+        * Input validation check: a stir4200/mcp2150 combinations sometimes
+        * results in frames with clen > remaining packet size. These are
+        * illegal; if we throw away just this frame then it seems to carry on
+        * fine
+        */
+       if (unlikely(skb->len < (clen + 1))) {
+               IRDA_DEBUG(2, "%s() throwing away illegal frame\n",
+                          __FUNCTION__ );
+               return;
+       }
+
        /*
         * If there are any data hiding in the control channel, we must
         * deliver it first. The side effect is that the control channel

diff --git a/net/irda/irlap_event.c b/net/irda/irlap_event.c
index 6d3aff862dc2ede8d8a96c4e9a0fb10db6bc4eca..6af86eba7463259522b8530dfbf361e4624d464b 100644 (file)
--- a/net/irda/irlap_event.c
+++ b/net/irda/irlap_event.c
@@ -1199,6 +1199,19 @@ static int irlap_state_nrm_p(struct irlap_cb *self, IRLAP_EVENT event,
 
        switch (event) {
        case RECV_I_RSP: /* Optimize for the common case */
+               if (unlikely(skb->len <= LAP_ADDR_HEADER + LAP_CTRL_HEADER)) {
+                       /*
+                        * Input validation check: a stir4200/mcp2150
+                        * combination sometimes results in an empty i:rsp.
+                        * This makes no sense; we can just ignore the frame
+                        * and send an rr:cmd immediately. This happens before
+                        * changing nr or ns so triggers a retransmit
+                        */
+                       irlap_wait_min_turn_around(self, &self->qos_tx);
+                       irlap_send_rr_frame(self, CMD_FRAME);
+                       /* Keep state */
+                       break;
+               }
                /* FIXME: must check for remote_busy below */
 #ifdef CONFIG_IRDA_FAST_RR
                /*