Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1187735

Re: [patch 2/2 v2] Staging: rtl8192e: pointer math bug in rtllib_rx_DELBA()

Show all headers | View raw

On 19.07.2015 12:52, Dan Carpenter wrote:
> The pointer math here was totally wrong so we were reading nonsense
> information from beyond the end of the buffer.  It could lead to an oops
> if that memory wasn't mapped.
> 
> The "pReasonCode" pointer is assigned but never used so I deleted it.
> 
> With-Fix-From: Mateusz Kulikowski <mateusz.kulikowski@gmail.com>
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> ---
> v2: Mateusz noticed some more pointer math bugs on the next lines.
> 
> diff --git a/drivers/staging/rtl8192e/rtl819x_BAProc.c b/drivers/staging/rtl8192e/rtl819x_BAProc.c
> index 60f536c..78ede4a 100644
> --- a/drivers/staging/rtl8192e/rtl819x_BAProc.c
> +++ b/drivers/staging/rtl8192e/rtl819x_BAProc.c
> @@ -428,7 +428,6 @@ int rtllib_rx_DELBA(struct rtllib_device *ieee, struct sk_buff *skb)
>  {
>  	 struct rtllib_hdr_3addr *delba = NULL;
>  	union delba_param_set *pDelBaParamSet = NULL;
> -	u16 *pReasonCode = NULL;
>  	u8 *dst = NULL;
>  
>  	if (skb->len < sizeof(struct rtllib_hdr_3addr) + 6) {
> @@ -453,9 +452,7 @@ int rtllib_rx_DELBA(struct rtllib_device *ieee, struct sk_buff *skb)
>  #endif
>  	delba = (struct rtllib_hdr_3addr *)skb->data;
>  	dst = (u8 *)(&delba->addr2[0]);
> -	delba += sizeof(struct rtllib_hdr_3addr);
> -	pDelBaParamSet = (union delba_param_set *)(delba+2);
> -	pReasonCode = (u16 *)(delba+4);
> +	pDelBaParamSet = (union delba_param_set *)&delba->payload[2];
>  
>  	if (pDelBaParamSet->field.Initiator == 1) {
>  		struct rx_ts_record *pRxTs;
> 

Acked/Tested-by me 

Thanks,
Mateusz
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Back to linux.kernel | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

[patch 2/2 v2] Staging: rtl8192e: pointer math bug in  rtllib_rx_DELBA() Dan Carpenter <dan.carpenter@oracle.com> - 2015-07-19 13:00 +0200
  Re: [patch 2/2 v2] Staging: rtl8192e: pointer math bug in rtllib_rx_DELBA() Mateusz Kulikowski <mateusz.kulikowski@gmail.com> - 2015-07-19 20:20 +0200

csiph-web