potential bug in bnep_net_set_mc

netdev.vger.kernel.org archive mirror
 help / color / mirror / Atom feed

* potential bug in bnep_net_set_mc_list()
@ 2010-06-18 23:09 Dan Carpenter
  2010-06-19  0:22 ` Gustavo F. Padovan
  0 siblings, 1 reply; 5+ messages in thread
From: Dan Carpenter @ 2010-06-18 23:09 UTC (permalink / raw)
  To: Jiri Pirko
  Cc: linux-bluetooth-u79uwXL29TY76Z2rM5mHXA,
	netdev-u79uwXL29TY76Z2rM5mHXA

This is from ff6e2163f28a: "net: convert multiple drivers to use
netdev_for_each_mc_addr, part7"

net/bluetooth/bnep/netdev.c
   101                  i = 0;
   102                  netdev_for_each_mc_addr(ha, dev) {
   103                          if (i == BNEP_MAX_MULTICAST_FILTERS)
                                ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

   104                                  break;
   105                          memcpy(__skb_put(skb, ETH_ALEN), ha->addr, ETH_ALEN);
   106                          memcpy(__skb_put(skb, ETH_ALEN), ha->addr, ETH_ALEN);
   107                  }

"i" is never incremented here so the check is always false.

regards,
dan carpenter

^ permalink raw reply	[flat|nested] 5+ messages in thread

* Re: potential bug in bnep_net_set_mc_list()
  2010-06-18 23:09 potential bug in bnep_net_set_mc_list() Dan Carpenter
@ 2010-06-19  0:22 ` Gustavo F. Padovan
  2010-06-19  0:24   ` [PATCH] Bluetooth: Bring back var 'i' increment Gustavo F. Padovan
  0 siblings, 1 reply; 5+ messages in thread
From: Gustavo F. Padovan @ 2010-06-19  0:22 UTC (permalink / raw)
  To: Dan Carpenter
  Cc: Jiri Pirko, linux-bluetooth-u79uwXL29TY76Z2rM5mHXA,
	netdev-u79uwXL29TY76Z2rM5mHXA

Hi Dan,

* Dan Carpenter <error27-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org> [2010-06-19 01:09:17 +0200]:

> This is from ff6e2163f28a: "net: convert multiple drivers to use
> netdev_for_each_mc_addr, part7"
> 
> net/bluetooth/bnep/netdev.c
>    101                  i = 0;
>    102                  netdev_for_each_mc_addr(ha, dev) {
>    103                          if (i == BNEP_MAX_MULTICAST_FILTERS)
>                                 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
> 
>    104                                  break;
>    105                          memcpy(__skb_put(skb, ETH_ALEN), ha->addr, ETH_ALEN);
>    106                          memcpy(__skb_put(skb, ETH_ALEN), ha->addr, ETH_ALEN);
>    107                  }
> 
> "i" is never incremented here so the check is always false.

Bring back the increment should fix this. I'll send a fix for this.

-- 
Gustavo F. Padovan
http://padovan.org

^ permalink raw reply	[flat|nested] 5+ messages in thread

* [PATCH] Bluetooth: Bring back var 'i' increment
  2010-06-19  0:22 ` Gustavo F. Padovan
@ 2010-06-19  0:24   ` Gustavo F. Padovan
       [not found]     ` <1276907040-23229-1-git-send-email-padovan-Y3ZbgMPKUGA34EUeqzHoZw@public.gmane.org>
  0 siblings, 1 reply; 5+ messages in thread
From: Gustavo F. Padovan @ 2010-06-19  0:24 UTC (permalink / raw)
  To: linux-bluetooth-u79uwXL29TY76Z2rM5mHXA
  Cc: gustavo-THi1TnShQwVAfugRpC6u6w, netdev-u79uwXL29TY76Z2rM5mHXA

commit ff6e2163f28a1094fb5ca5950fe2b43c3cf6bc7a accidentally added a
regression on the bnep code. Fixing it.

Signed-off-by: Gustavo F. Padovan <padovan-Y3ZbgMPKUGA34EUeqzHoZw@public.gmane.org>
---
 net/bluetooth/bnep/netdev.c |    2 ++
 1 files changed, 2 insertions(+), 0 deletions(-)

diff --git a/net/bluetooth/bnep/netdev.c b/net/bluetooth/bnep/netdev.c
index 0faad5c..8c100c9 100644
--- a/net/bluetooth/bnep/netdev.c
+++ b/net/bluetooth/bnep/netdev.c
@@ -104,6 +104,8 @@ static void bnep_net_set_mc_list(struct net_device *dev)
 				break;
 			memcpy(__skb_put(skb, ETH_ALEN), ha->addr, ETH_ALEN);
 			memcpy(__skb_put(skb, ETH_ALEN), ha->addr, ETH_ALEN);
+
+			i++;
 		}
 		r->len = htons(skb->len - len);
 	}
-- 
1.6.4.4

^ permalink raw reply related	[flat|nested] 5+ messages in thread

[parent not found: <1276907040-23229-1-git-send-email-padovan-Y3ZbgMPKUGA34EUeqzHoZw@public.gmane.org>]

* Re: [PATCH] Bluetooth: Bring back var 'i' increment
       [not found]     ` <1276907040-23229-1-git-send-email-padovan-Y3ZbgMPKUGA34EUeqzHoZw@public.gmane.org>
@ 2010-06-19  0:28       ` Gustavo F. Padovan
  2010-06-25  5:08         ` David Miller
  0 siblings, 1 reply; 5+ messages in thread
From: Gustavo F. Padovan @ 2010-06-19  0:28 UTC (permalink / raw)
  To: Gustavo F. Padovan
  Cc: linux-bluetooth-u79uwXL29TY76Z2rM5mHXA,
	netdev-u79uwXL29TY76Z2rM5mHXA, marcel-kz+m5ild9QBg9hUCZPvPmw

* Gustavo F. Padovan <padovan-Y3ZbgMPKUGA34EUeqzHoZw@public.gmane.org> [2010-06-18 21:24:00 -0300]:

> commit ff6e2163f28a1094fb5ca5950fe2b43c3cf6bc7a accidentally added a
> regression on the bnep code. Fixing it.
> 
> Signed-off-by: Gustavo F. Padovan <padovan-Y3ZbgMPKUGA34EUeqzHoZw@public.gmane.org>
> ---
>  net/bluetooth/bnep/netdev.c |    2 ++
>  1 files changed, 2 insertions(+), 0 deletions(-)
> 
> diff --git a/net/bluetooth/bnep/netdev.c b/net/bluetooth/bnep/netdev.c
> index 0faad5c..8c100c9 100644
> --- a/net/bluetooth/bnep/netdev.c
> +++ b/net/bluetooth/bnep/netdev.c
> @@ -104,6 +104,8 @@ static void bnep_net_set_mc_list(struct net_device *dev)
>  				break;
>  			memcpy(__skb_put(skb, ETH_ALEN), ha->addr, ETH_ALEN);
>  			memcpy(__skb_put(skb, ETH_ALEN), ha->addr, ETH_ALEN);
> +
> +			i++;
>  		}
>  		r->len = htons(skb->len - len);
>  	}
> -- 

Marcel, if you want I can carry the fix on my tree for -next.

-- 
Gustavo F. Padovan
http://padovan.org

^ permalink raw reply	[flat|nested] 5+ messages in thread

* Re: [PATCH] Bluetooth: Bring back var 'i' increment
  2010-06-19  0:28       ` Gustavo F. Padovan
@ 2010-06-25  5:08         ` David Miller
  0 siblings, 0 replies; 5+ messages in thread
From: David Miller @ 2010-06-25  5:08 UTC (permalink / raw)
  To: gustavo-THi1TnShQwVAfugRpC6u6w
  Cc: padovan-Y3ZbgMPKUGA34EUeqzHoZw,
	linux-bluetooth-u79uwXL29TY76Z2rM5mHXA,
	netdev-u79uwXL29TY76Z2rM5mHXA, marcel-kz+m5ild9QBg9hUCZPvPmw

From: "Gustavo F. Padovan" <gustavo-THi1TnShQwVAfugRpC6u6w@public.gmane.org>
Date: Fri, 18 Jun 2010 21:28:07 -0300

> * Gustavo F. Padovan <padovan-Y3ZbgMPKUGA34EUeqzHoZw@public.gmane.org> [2010-06-18 21:24:00 -0300]:
> 
>> commit ff6e2163f28a1094fb5ca5950fe2b43c3cf6bc7a accidentally added a
>> regression on the bnep code. Fixing it.
>> 
>> Signed-off-by: Gustavo F. Padovan <padovan-Y3ZbgMPKUGA34EUeqzHoZw@public.gmane.org>
 ...
> Marcel, if you want I can carry the fix on my tree for -next.

I'll apply this bug fix to net-2.6 so it doesn't just rot like it is
currently.

Thanks.

^ permalink raw reply	[flat|nested] 5+ messages in thread

end of thread, other threads:[~2010-06-25  5:08 UTC | newest]

Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2010-06-18 23:09 potential bug in bnep_net_set_mc_list() Dan Carpenter
2010-06-19  0:22 ` Gustavo F. Padovan
2010-06-19  0:24   ` [PATCH] Bluetooth: Bring back var 'i' increment Gustavo F. Padovan
     [not found]     ` <1276907040-23229-1-git-send-email-padovan-Y3ZbgMPKUGA34EUeqzHoZw@public.gmane.org>
2010-06-19  0:28       ` Gustavo F. Padovan
2010-06-25  5:08         ` David Miller

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).