On Wed, Feb 22, 2023 at 04:59:41PM +0300, Dan Carpenter wrote:
> Here the code is testing to see if skb->len meets a minimum size
> requirement. However if skb->len is very small then the ETH_HLEN
> subtraction will result in a negative which is then type promoted
> to an unsigned int and the condition will be true.
>
> Generally, when you have an untrusted variable like skb->len, you
> should move all the math to the other side of the comparison.
>
> Fixes: 15865124feed ("staging: r8188eu: introduce new core dir for RTL8188eu driver")
> Signed-off-by: Dan Carpenter <error27@xxxxxxxxx>
> ---
> Compile tested only. This is basic algebra of moving parts of the
> equation from one side to the other and I am surprisingly bad at
> something that I was supposed to have learned in 9th grade.
>
> drivers/staging/r8188eu/core/rtw_br_ext.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
This driver is now deleted, so no need to worry about this anymore.
thanks,
greg k-h
