[PATCH] cfg80211: Fix array-bounds warning in fragment copy

Path	csiph.com!news.mixmin.net!aioe.org!news.servidellagleba.it!bofh.it!news.nic.it!robomod
From	Matthias Kaehlcke <mka@chromium.org>
Newsgroups	linux.kernel
Subject	[PATCH] cfg80211: Fix array-bounds warning in fragment copy
Date	Sat, 25 Mar 2017 02:10:01 +0100
Message-ID	<toInn-1Fh-13@gated-at.bofh.it> (permalink)
X-Google-Dkim-Signature	v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id; bh=WAHjSnHoqEexmxoK+uZUUI2yYUqru5stjIQzQSPQuus=; b=WBsLS0IIPR/PTbjNh1GfyCtLi3EbYTjkVxXi7rXH21Nn3sO3c9D9JFn7Xu1gQT15dy rTKvnB5T817vD6QjH46QZiUfICLA927KIy+ThH1w48SojFA0ypNJZZx3nZ9i+XTQUgVb /EFNc4SP3ElcYt59nkaj//1N70o3QSXCgRxcSYNBt/b1xCcLRnPsPwU+2sHHWBcyDJ18 qhDucrY9T9nhXbSdmG0+rwSePdlNwyefJY5hvb3qa1CXcG0s+Hozm1o4blqTnBka5r1k KzpMZl28Zb83W1LlvWeKI26vp3ve07mQfKjlEPbMEc1yuCQqrQ8v9Lhg1K2MzW/BZEVs nm9w==
X-Gm-Message-State	AFeK/H2Z82i4CHLMP0v/yb6NvepOi7Pmib8UzZDbKUkBCOYv+BQThmVPvG/zj0sHMH+Ny7OT
X-Received	by 10.98.80.93 with SMTP id e90mr12782205pfb.7.1490404035828; Fri, 24 Mar 2017 18:07:15 -0700 (PDT)
X-Mailer	git-send-email 2.12.1.578.ge9c3154ca4-goog
Sender	robomod@news.nic.it
List-ID	<linux-kernel.vger.kernel.org>
X-Mailing-List	linux-kernel@vger.kernel.org
Approved	robomod@news.nic.it
Lines	35
Organization	linux.* mail to news gateway
X-Original-Cc	netdev@vger.kernel.org, linux-kernel@vger.kernel.org, Grant Grundler <grundler@chromium.org>, Matthias Kaehlcke <mka@chromium.org>
X-Original-Date	Fri, 24 Mar 2017 18:06:44 -0700
X-Original-Message-ID	<20170325010644.190368-1-mka@chromium.org>
X-Original-Sender	linux-kernel-owner@vger.kernel.org
Xref	csiph.com linux.kernel:1609053

Show key headers only | View raw

__ieee80211_amsdu_copy_frag intentionally initializes a pointer to
array[-1] to increment it later to valid values. clang rightfully
generates an array-bounds warning on the initialization statement.
Work around this by initializing the pointer to array[0] and
decrementing it later, which allows to leave the rest of the
algorithm untouched.

Signed-off-by: Matthias Kaehlcke <mka@chromium.org>
---
 net/wireless/util.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/wireless/util.c b/net/wireless/util.c
index 68e5f2ecee1a..d3d459e4a070 100644
--- a/net/wireless/util.c
+++ b/net/wireless/util.c
@@ -659,7 +659,7 @@ __ieee80211_amsdu_copy_frag(struct sk_buff *skb, struct sk_buff *frame,
 			    int offset, int len)
 {
 	struct skb_shared_info *sh = skb_shinfo(skb);
-	const skb_frag_t *frag = &sh->frags[-1];
+	const skb_frag_t *frag = &sh->frags[0];
 	struct page *frag_page;
 	void *frag_ptr;
 	int frag_len, frag_size;
@@ -669,6 +669,7 @@ __ieee80211_amsdu_copy_frag(struct sk_buff *skb, struct sk_buff *frame,
 	frag_page = virt_to_head_page(skb->head);
 	frag_ptr = skb->data;
 	frag_size = head_size;
+	frag--;
 
 	while (offset >= frag_size) {
 		offset -= frag_size;
-- 
2.12.1.578.ge9c3154ca4-goog

Back to linux.kernel | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

[PATCH] cfg80211: Fix array-bounds warning in fragment copy Matthias Kaehlcke <mka@chromium.org> - 2017-03-25 02:10 +0100
  Re: [PATCH] cfg80211: Fix array-bounds warning in fragment copy Johannes Berg <johannes@sipsolutions.net> - 2017-03-27 12:50 +0200
    Re: [PATCH] cfg80211: Fix array-bounds warning in fragment copy Felix Fietkau <nbd@nbd.name> - 2017-03-27 13:40 +0200
      Re: [PATCH] cfg80211: Fix array-bounds warning in fragment copy Johannes Berg <johannes@sipsolutions.net> - 2017-03-27 13:40 +0200

csiph-web