[PATCH] cfg80211: Fix array-bounds warning in fragment copy

From	Matthias Kaehlcke <mka@chromium.org>
Newsgroups	linux.kernel
Subject	[PATCH] cfg80211: Fix array-bounds warning in fragment copy
Date	2017-03-25 02:10 +0100
Message-ID	<toInn-1Fh-13@gated-at.bofh.it> (permalink)
Organization	linux.* mail to news gateway

Show all headers | View raw

__ieee80211_amsdu_copy_frag intentionally initializes a pointer to
array[-1] to increment it later to valid values. clang rightfully
generates an array-bounds warning on the initialization statement.
Work around this by initializing the pointer to array[0] and
decrementing it later, which allows to leave the rest of the
algorithm untouched.

Signed-off-by: Matthias Kaehlcke <mka@chromium.org>
---
 net/wireless/util.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/wireless/util.c b/net/wireless/util.c
index 68e5f2ecee1a..d3d459e4a070 100644
--- a/net/wireless/util.c
+++ b/net/wireless/util.c
@@ -659,7 +659,7 @@ __ieee80211_amsdu_copy_frag(struct sk_buff *skb, struct sk_buff *frame,
 			    int offset, int len)
 {
 	struct skb_shared_info *sh = skb_shinfo(skb);
-	const skb_frag_t *frag = &sh->frags[-1];
+	const skb_frag_t *frag = &sh->frags[0];
 	struct page *frag_page;
 	void *frag_ptr;
 	int frag_len, frag_size;
@@ -669,6 +669,7 @@ __ieee80211_amsdu_copy_frag(struct sk_buff *skb, struct sk_buff *frame,
 	frag_page = virt_to_head_page(skb->head);
 	frag_ptr = skb->data;
 	frag_size = head_size;
+	frag--;
 
 	while (offset >= frag_size) {
 		offset -= frag_size;
-- 
2.12.1.578.ge9c3154ca4-goog

Back to linux.kernel | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

[PATCH] cfg80211: Fix array-bounds warning in fragment copy Matthias Kaehlcke <mka@chromium.org> - 2017-03-25 02:10 +0100
  Re: [PATCH] cfg80211: Fix array-bounds warning in fragment copy Johannes Berg <johannes@sipsolutions.net> - 2017-03-27 12:50 +0200
    Re: [PATCH] cfg80211: Fix array-bounds warning in fragment copy Felix Fietkau <nbd@nbd.name> - 2017-03-27 13:40 +0200
      Re: [PATCH] cfg80211: Fix array-bounds warning in fragment copy Johannes Berg <johannes@sipsolutions.net> - 2017-03-27 13:40 +0200

csiph-web