* [patch 2/2 v2] Staging: rtl8192e: pointer math bug in rtllib_rx_DELBA() [not found] <55A962E4.2070708@gmail.com> @ 2015-07-19 10:52 ` Dan Carpenter 2015-07-19 18:17 ` Mateusz Kulikowski 0 siblings, 1 reply; 2+ messages in thread From: Dan Carpenter @ 2015-07-19 10:52 UTC (permalink / raw) To: Greg Kroah-Hartman Cc: Mateusz Kulikowski, Vaishali Thakkar, Mahati Chamarthy, Chen Gang, Matthew Casey, devel, linux-kernel, kernel-janitors The pointer math here was totally wrong so we were reading nonsense information from beyond the end of the buffer. It could lead to an oops if that memory wasn't mapped. The "pReasonCode" pointer is assigned but never used so I deleted it. With-Fix-From: Mateusz Kulikowski <mateusz.kulikowski@gmail.com> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> --- v2: Mateusz noticed some more pointer math bugs on the next lines. diff --git a/drivers/staging/rtl8192e/rtl819x_BAProc.c b/drivers/staging/rtl8192e/rtl819x_BAProc.c index 60f536c..78ede4a 100644 --- a/drivers/staging/rtl8192e/rtl819x_BAProc.c +++ b/drivers/staging/rtl8192e/rtl819x_BAProc.c @@ -428,7 +428,6 @@ int rtllib_rx_DELBA(struct rtllib_device *ieee, struct sk_buff *skb) { struct rtllib_hdr_3addr *delba = NULL; union delba_param_set *pDelBaParamSet = NULL; - u16 *pReasonCode = NULL; u8 *dst = NULL; if (skb->len < sizeof(struct rtllib_hdr_3addr) + 6) { @@ -453,9 +452,7 @@ int rtllib_rx_DELBA(struct rtllib_device *ieee, struct sk_buff *skb) #endif delba = (struct rtllib_hdr_3addr *)skb->data; dst = (u8 *)(&delba->addr2[0]); - delba += sizeof(struct rtllib_hdr_3addr); - pDelBaParamSet = (union delba_param_set *)(delba+2); - pReasonCode = (u16 *)(delba+4); + pDelBaParamSet = (union delba_param_set *)&delba->payload[2]; if (pDelBaParamSet->field.Initiator == 1) { struct rx_ts_record *pRxTs; ^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [patch 2/2 v2] Staging: rtl8192e: pointer math bug in rtllib_rx_DELBA() 2015-07-19 10:52 ` [patch 2/2 v2] Staging: rtl8192e: pointer math bug in rtllib_rx_DELBA() Dan Carpenter @ 2015-07-19 18:17 ` Mateusz Kulikowski 0 siblings, 0 replies; 2+ messages in thread From: Mateusz Kulikowski @ 2015-07-19 18:17 UTC (permalink / raw) To: Dan Carpenter, Greg Kroah-Hartman Cc: Vaishali Thakkar, Mahati Chamarthy, Chen Gang, Matthew Casey, devel, linux-kernel, kernel-janitors On 19.07.2015 12:52, Dan Carpenter wrote: > The pointer math here was totally wrong so we were reading nonsense > information from beyond the end of the buffer. It could lead to an oops > if that memory wasn't mapped. > > The "pReasonCode" pointer is assigned but never used so I deleted it. > > With-Fix-From: Mateusz Kulikowski <mateusz.kulikowski@gmail.com> > Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> > --- > v2: Mateusz noticed some more pointer math bugs on the next lines. > > diff --git a/drivers/staging/rtl8192e/rtl819x_BAProc.c b/drivers/staging/rtl8192e/rtl819x_BAProc.c > index 60f536c..78ede4a 100644 > --- a/drivers/staging/rtl8192e/rtl819x_BAProc.c > +++ b/drivers/staging/rtl8192e/rtl819x_BAProc.c > @@ -428,7 +428,6 @@ int rtllib_rx_DELBA(struct rtllib_device *ieee, struct sk_buff *skb) > { > struct rtllib_hdr_3addr *delba = NULL; > union delba_param_set *pDelBaParamSet = NULL; > - u16 *pReasonCode = NULL; > u8 *dst = NULL; > > if (skb->len < sizeof(struct rtllib_hdr_3addr) + 6) { > @@ -453,9 +452,7 @@ int rtllib_rx_DELBA(struct rtllib_device *ieee, struct sk_buff *skb) > #endif > delba = (struct rtllib_hdr_3addr *)skb->data; > dst = (u8 *)(&delba->addr2[0]); > - delba += sizeof(struct rtllib_hdr_3addr); > - pDelBaParamSet = (union delba_param_set *)(delba+2); > - pReasonCode = (u16 *)(delba+4); > + pDelBaParamSet = (union delba_param_set *)&delba->payload[2]; > > if (pDelBaParamSet->field.Initiator == 1) { > struct rx_ts_record *pRxTs; > Acked/Tested-by me Thanks, Mateusz ^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2015-07-19 18:17 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
[not found] <55A962E4.2070708@gmail.com>
2015-07-19 10:52 ` [patch 2/2 v2] Staging: rtl8192e: pointer math bug in rtllib_rx_DELBA() Dan Carpenter
2015-07-19 18:17 ` Mateusz Kulikowski
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox