Re: [patch 2/2 v2] Staging: rtl8192e: pointer math bug in rtllib_rx_DELBA()

[Mateusz Kulikowski <mateusz.kulikowski@gmail.com>]

On 19.07.2015 12:52, Dan Carpenter wrote:
> The pointer math here was totally wrong so we were reading nonsense
> information from beyond the end of the buffer.  It could lead to an oops
> if that memory wasn't mapped.
> 
> The "pReasonCode" pointer is assigned but never used so I deleted it.
> 
> With-Fix-From: Mateusz Kulikowski <mateusz.kulikowski@gmail.com>
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> ---
> v2: Mateusz noticed some more pointer math bugs on the next lines.
> 
> diff --git a/drivers/staging/rtl8192e/rtl819x_BAProc.c b/drivers/staging/rtl8192e/rtl819x_BAProc.c
> index 60f536c..78ede4a 100644
> --- a/drivers/staging/rtl8192e/rtl819x_BAProc.c
> +++ b/drivers/staging/rtl8192e/rtl819x_BAProc.c
> @@ -428,7 +428,6 @@ int rtllib_rx_DELBA(struct rtllib_device *ieee, struct sk_buff *skb)
>  {
>  	 struct rtllib_hdr_3addr *delba = NULL;
>  	union delba_param_set *pDelBaParamSet = NULL;
> -	u16 *pReasonCode = NULL;
>  	u8 *dst = NULL;
>  
>  	if (skb->len < sizeof(struct rtllib_hdr_3addr) + 6) {
> @@ -453,9 +452,7 @@ int rtllib_rx_DELBA(struct rtllib_device *ieee, struct sk_buff *skb)
>  #endif
>  	delba = (struct rtllib_hdr_3addr *)skb->data;
>  	dst = (u8 *)(&delba->addr2[0]);
> -	delba += sizeof(struct rtllib_hdr_3addr);
> -	pDelBaParamSet = (union delba_param_set *)(delba+2);
> -	pReasonCode = (u16 *)(delba+4);
> +	pDelBaParamSet = (union delba_param_set *)&delba->payload[2];
>  
>  	if (pDelBaParamSet->field.Initiator == 1) {
>  		struct rx_ts_record *pRxTs;
> 

Acked/Tested-by me 

Thanks,
Mateusz