Can anyone help reviewing it and merge to opensuse 11.3 and 11.4 kernel git ? It is about a security update, I send here for reviewing. 2011/11/29 Chen, Chien-Chia :

From: Gertjan van Wingerde

Git-commit : c85ce65ecac078ab1a1835c87c4a6319cf74660a Patch-mainline : v2.6.39-rc3 Reference : bnc#720741

 b43: allocate receive buffers big enough for max frame len + offset

 Otherwise, skb_put inside of dma_rx can fail...

 https://bugzilla.kernel.org/show_bug.cgi?id=32042

 Signed-off-by: John W. Linville  Acked-by: Larry Finger  Cc: stable@kernel.org ---  drivers/net/wireless/b43/dma.c |    2 +-  drivers/net/wireless/b43/dma.h |    2 +-  2 files changed, 2 insertions(+), 2 deletions(-)

--- a/drivers/net/wireless/b43/dma.c +++ b/drivers/net/wireless/b43/dma.c @@ -1541,7 +1541,7 @@ static void dma_rx(struct b43_dmaring *r                dmaaddr = meta->dmaaddr;                goto drop_recycle_buffer;        } -       if (unlikely(len > ring->rx_buffersize)) { +       if (unlikely(len + ring->frameoffset > ring->rx_buffersize)) {                /* The data did not fit into one descriptor buffer                 * and is split over multiple buffers.                 * This should never happen, as we try to allocate buffers --- a/drivers/net/wireless/b43/dma.h +++ b/drivers/net/wireless/b43/dma.h @@ -163,7 +163,7 @@ struct b43_dmadesc_generic {  /* DMA engine tuning knobs */  #define B43_TXRING_SLOTS               256  #define B43_RXRING_SLOTS               64 -#define B43_DMA0_RX_BUFFERSIZE         IEEE80211_MAX_FRAME_LEN +#define B43_DMA0_RX_BUFFERSIZE         (B43_DMA0_RX_FRAMEOFFSET + IEEE80211_MAX_FRAME_LEN)

 /* Pointer poison */  #define B43_DMA_PTR_POISON             ((void *)ERR_PTR(-ENOMEM)) -- To unsubscribe, e-mail: opensuse-kernel+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse-kernel+owner@opensuse.org

-- To unsubscribe, e-mail: opensuse-kernel+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse-kernel+owner@opensuse.org