Hello Bing Zhao,
The patch 5e6e3a92b9a4: "wireless: mwifiex: initial commit for
Marvell mwifiex driver" from Mar 21, 2011, leads to the following
static checker warning:
drivers/net/wireless/marvell/mwifiex/sta_cmd.c:133 mwifiex_cmd_802_11_snmp_mib()
warn: potential memory corrupting cast 2 vs 1 bytes
drivers/net/wireless/marvell/mwifiex/sta_cmd.c
112 static int mwifiex_cmd_802_11_snmp_mib(struct mwifiex_private *priv,
113 struct host_cmd_ds_command *cmd,
114 u16 cmd_action, u32 cmd_oid,
115 u16 *ul_temp)
116 {
117 struct host_cmd_ds_802_11_snmp_mib *snmp_mib = &cmd->params.smib;
118
119 mwifiex_dbg(priv->adapter, CMD,
120 "cmd: SNMP_CMD: cmd_oid = 0x%x\n", cmd_oid);
121 cmd->command = cpu_to_le16(HostCmd_CMD_802_11_SNMP_MIB);
122 cmd->size = cpu_to_le16(sizeof(struct host_cmd_ds_802_11_snmp_mib)
123 - 1 + S_DS_GEN);
124
125 snmp_mib->oid = cpu_to_le16((u16)cmd_oid);
126 if (cmd_action == HostCmd_ACT_GEN_GET) {
127 snmp_mib->query_type = cpu_to_le16(HostCmd_ACT_GEN_GET);
128 snmp_mib->buf_size = cpu_to_le16(MAX_SNMP_BUF_SIZE);
129 le16_add_cpu(&cmd->size, MAX_SNMP_BUF_SIZE);
130 } else if (cmd_action == HostCmd_ACT_GEN_SET) {
131 snmp_mib->query_type = cpu_to_le16(HostCmd_ACT_GEN_SET);
132 snmp_mib->buf_size = cpu_to_le16(sizeof(u16));
133 *((__le16 *) (snmp_mib->value)) = cpu_to_le16(*ul_temp);
^^^^^^^^^^^^^^^
We're writing two bytes here but it's only a 1 byte array. It's a
__packed array as well so there isn't any padding.
134 le16_add_cpu(&cmd->size, sizeof(u16));
135 }
136
137 mwifiex_dbg(priv->adapter, CMD,
138 "cmd: SNMP_CMD: Action=0x%x, OID=0x%x,\t"
139 "OIDSize=0x%x, Value=0x%x\n",
140 cmd_action, cmd_oid, le16_to_cpu(snmp_mib->buf_size),
141 le16_to_cpu(*(__le16 *)snmp_mib->value));
142 return 0;
143 }
regards,
dan carpenter
--
To unsubscribe from this list: send the line "unsubscribe linux-wireless" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
