Re: [patch 2/2] Staging: rtl8192e: pointer math bug in rtllib_rx_DELBA()

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Fri, Jul 17, 2015 at 10:17:40PM +0200, Mateusz Kulikowski wrote:
> > diff --git a/drivers/staging/rtl8192e/rtl819x_BAProc.c b/drivers/staging/rtl8192e/rtl819x_BAProc.c
> > index 60f536c..98e6c4e 100644
> > --- a/drivers/staging/rtl8192e/rtl819x_BAProc.c
> > +++ b/drivers/staging/rtl8192e/rtl819x_BAProc.c
> > @@ -453,7 +453,7 @@ int rtllib_rx_DELBA(struct rtllib_device *ieee, struct sk_buff *skb)
> >  #endif
> >  	delba = (struct rtllib_hdr_3addr *)skb->data;
> >  	dst = (u8 *)(&delba->addr2[0]);
> > -	delba += sizeof(struct rtllib_hdr_3addr);
> > +	delba++;
> >  	pDelBaParamSet = (union delba_param_set *)(delba+2);
> >  	pReasonCode = (u16 *)(delba+4);
> >  
> > 
> 
> Ack/+1, 
> 
> It's not the last fix for 'delba' unfortunately :(
> 
> Next lines should use delba as u8 if I see correctly
> See rtllib_DELBA() (line 141) - It first fills skb with rtllib_hdr_3_addr,
> and then adds skb delbaparam_set and reasonCode (as a 6 bytes).
> Or I'm tired - will re-check tomorrow.

All this pointer math would have worked if "delba" were a void pointer,
but that's a bit ugly.  Anyway, I'll send a proper fix for this.

regards,
dan carpenter

--
To unsubscribe from this list: send the line "unsubscribe kernel-janitors" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html



[Index of Archives]     [Kernel Development]     [Kernel Announce]     [Kernel Newbies]     [Linux Networking Development]     [Share Photos]     [IDE]     [Security]     [Git]     [Netfilter]     [Yosemite News]     [MIPS Linux]     [ARM Linux]     [Device Mapper]

  Powered by Linux