Here is the static checker warning.
drivers/net/arcnet/capmode.c:78 rx()
error: __memcpy() 'pktbuf + 4 + + 4' too small (11 vs 15)
drivers/net/arcnet/capmode.c
42 static void rx(struct net_device *dev, int bufnum,
43 struct archdr *pkthdr, int length)
44 {
45 struct arcnet_local *lp = netdev_priv(dev);
46 struct sk_buff *skb;
47 struct archdr *pkt = pkthdr;
^^^^^^^^^^^^
Never used assignment.
48 char *pktbuf, *pkthdrbuf;
49 int ofs;
50
51 arc_printk(D_DURING, dev, "it's a raw(cap) packet (length=%d)\n",
52 length);
53
54 if (length >= MinTU)
55 ofs = 512 - length;
56 else
57 ofs = 256 - length;
58
59 skb = alloc_skb(length + ARC_HDR_SIZE + sizeof(int), GFP_ATOMIC);
60 if (!skb) {
61 dev->stats.rx_dropped++;
62 return;
63 }
64 skb_put(skb, length + ARC_HDR_SIZE + sizeof(int));
65 skb->dev = dev;
66 skb_reset_mac_header(skb);
67 pkt = (struct archdr *)skb_mac_header(skb);
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Assigned here.
68 skb_pull(skb, ARC_HDR_SIZE);
69
70 /* up to sizeof(pkt->soft) has already been copied from the card
71 * squeeze in an int for the cap encapsulation
72 * use these variables to be sure we count in bytes, not in
73 * sizeof(struct archdr)
74 */
75 pktbuf = (char *)pkt;
76 pkthdrbuf = (char *)pkthdr;
77 memcpy(pktbuf, pkthdrbuf, ARC_HDR_SIZE + sizeof(pkt->soft.cap.proto));
78 memcpy(pktbuf + ARC_HDR_SIZE + sizeof(pkt->soft.cap.proto) + sizeof(int),
^^^^^^^^^^^
It looks like we break the memcpy into two peices so that we don't write
over this sizeof(int).
79 pkthdrbuf + ARC_HDR_SIZE + sizeof(pkt->soft.cap.proto),
80 sizeof(struct archdr) - ARC_HDR_SIZE - sizeof(pkt->soft.cap.proto));
But shouldn't the length value also say - sizeof(int)? It looks like
we end up corrupting stack in the arcnet_rx() function.
81
82 if (length > sizeof(pkt->soft))
83 lp->hw.copy_from_card(dev, bufnum, ofs + sizeof(pkt->soft),
84 pkt->soft.raw + sizeof(pkt->soft)
85 + sizeof(int),
86 length - sizeof(pkt->soft));
87
regards,
dan carpenter
--
To unsubscribe from this list: send the line "unsubscribe kernel-janitors" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
