Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1187562 > unrolled thread
| Started by | Dan Carpenter <dan.carpenter@oracle.com> |
|---|---|
| First post | 2015-07-19 13:00 +0200 |
| Last post | 2015-07-19 20:20 +0200 |
| Articles | 2 — 2 participants |
Back to article view | Back to linux.kernel
This discussion starts older than the indexed window; earlier articles aren't shown. The article labeled Started by
below is the oldest one visible, not the original post.
[patch 2/2 v2] Staging: rtl8192e: pointer math bug in rtllib_rx_DELBA() Dan Carpenter <dan.carpenter@oracle.com> - 2015-07-19 13:00 +0200
Re: [patch 2/2 v2] Staging: rtl8192e: pointer math bug in rtllib_rx_DELBA() Mateusz Kulikowski <mateusz.kulikowski@gmail.com> - 2015-07-19 20:20 +0200
| From | Dan Carpenter <dan.carpenter@oracle.com> |
|---|---|
| Date | 2015-07-19 13:00 +0200 |
| Subject | [patch 2/2 v2] Staging: rtl8192e: pointer math bug in rtllib_rx_DELBA() |
| Message-ID | <pNUu6-sz-13@gated-at.bofh.it> |
The pointer math here was totally wrong so we were reading nonsense
information from beyond the end of the buffer. It could lead to an oops
if that memory wasn't mapped.
The "pReasonCode" pointer is assigned but never used so I deleted it.
With-Fix-From: Mateusz Kulikowski <mateusz.kulikowski@gmail.com>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
v2: Mateusz noticed some more pointer math bugs on the next lines.
diff --git a/drivers/staging/rtl8192e/rtl819x_BAProc.c b/drivers/staging/rtl8192e/rtl819x_BAProc.c
index 60f536c..78ede4a 100644
--- a/drivers/staging/rtl8192e/rtl819x_BAProc.c
+++ b/drivers/staging/rtl8192e/rtl819x_BAProc.c
@@ -428,7 +428,6 @@ int rtllib_rx_DELBA(struct rtllib_device *ieee, struct sk_buff *skb)
{
struct rtllib_hdr_3addr *delba = NULL;
union delba_param_set *pDelBaParamSet = NULL;
- u16 *pReasonCode = NULL;
u8 *dst = NULL;
if (skb->len < sizeof(struct rtllib_hdr_3addr) + 6) {
@@ -453,9 +452,7 @@ int rtllib_rx_DELBA(struct rtllib_device *ieee, struct sk_buff *skb)
#endif
delba = (struct rtllib_hdr_3addr *)skb->data;
dst = (u8 *)(&delba->addr2[0]);
- delba += sizeof(struct rtllib_hdr_3addr);
- pDelBaParamSet = (union delba_param_set *)(delba+2);
- pReasonCode = (u16 *)(delba+4);
+ pDelBaParamSet = (union delba_param_set *)&delba->payload[2];
if (pDelBaParamSet->field.Initiator == 1) {
struct rx_ts_record *pRxTs;
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[toc] | [next] | [standalone]
| From | Mateusz Kulikowski <mateusz.kulikowski@gmail.com> |
|---|---|
| Date | 2015-07-19 20:20 +0200 |
| Subject | Re: [patch 2/2 v2] Staging: rtl8192e: pointer math bug in rtllib_rx_DELBA() |
| Message-ID | <pO1lT-24B-9@gated-at.bofh.it> |
| In reply to | #1187562 |
On 19.07.2015 12:52, Dan Carpenter wrote:
> The pointer math here was totally wrong so we were reading nonsense
> information from beyond the end of the buffer. It could lead to an oops
> if that memory wasn't mapped.
>
> The "pReasonCode" pointer is assigned but never used so I deleted it.
>
> With-Fix-From: Mateusz Kulikowski <mateusz.kulikowski@gmail.com>
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> ---
> v2: Mateusz noticed some more pointer math bugs on the next lines.
>
> diff --git a/drivers/staging/rtl8192e/rtl819x_BAProc.c b/drivers/staging/rtl8192e/rtl819x_BAProc.c
> index 60f536c..78ede4a 100644
> --- a/drivers/staging/rtl8192e/rtl819x_BAProc.c
> +++ b/drivers/staging/rtl8192e/rtl819x_BAProc.c
> @@ -428,7 +428,6 @@ int rtllib_rx_DELBA(struct rtllib_device *ieee, struct sk_buff *skb)
> {
> struct rtllib_hdr_3addr *delba = NULL;
> union delba_param_set *pDelBaParamSet = NULL;
> - u16 *pReasonCode = NULL;
> u8 *dst = NULL;
>
> if (skb->len < sizeof(struct rtllib_hdr_3addr) + 6) {
> @@ -453,9 +452,7 @@ int rtllib_rx_DELBA(struct rtllib_device *ieee, struct sk_buff *skb)
> #endif
> delba = (struct rtllib_hdr_3addr *)skb->data;
> dst = (u8 *)(&delba->addr2[0]);
> - delba += sizeof(struct rtllib_hdr_3addr);
> - pDelBaParamSet = (union delba_param_set *)(delba+2);
> - pReasonCode = (u16 *)(delba+4);
> + pDelBaParamSet = (union delba_param_set *)&delba->payload[2];
>
> if (pDelBaParamSet->field.Initiator == 1) {
> struct rx_ts_record *pRxTs;
>
Acked/Tested-by me
Thanks,
Mateusz
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[toc] | [prev] | [standalone]
Back to top | Article view | linux.kernel
csiph-web