A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-13 00:00:00 -04:00
Code Issues Projects Releases Packages Wiki Activity

Staging: rtl8192u: pointer math bug in ieee80211_rx_DELBA()

Browse source 
Smatch complains because "delba" is a pointer to struct
rtl_80211_hdr_3addr so the "delba += sizeof(struct rtl_80211_hdr_3addr);"
is clearly wrong.  We are reading nonsense data from beyond the end of
the buffer and could oops if that memory isn't mapped.

It turns out the next two statements are also wrong. We should delete
the += sizeof() statement and "delba+2" should be "&delba->payload[2]".
"pReasonCode" isn't used so I deleted that.

With-Fix-From: Mateusz Kulikowski <mateusz.kulikowski@gmail.com>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Dan Carpenter 2015-07-19 13:52:17 +03:00 • committed by Greg Kroah-Hartman
commit 047db9915e
1 changed files with 1 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

5
drivers/staging/rtl8192u/ieee80211/rtl819x_BAProc.c
View file

@ -571,7 +571,6 @@ int ieee80211_rx_DELBA(struct ieee80211_device *ieee, struct sk_buff *skb)
{
struct rtl_80211_hdr_3addr *delba = NULL;
PDELBA_PARAM_SET pDelBaParamSet = NULL;
u16 *pReasonCode = NULL;
u8 *dst = NULL;
if (skb->len < sizeof(struct rtl_80211_hdr_3addr) + 6) {
@ -592,9 +591,7 @@ int ieee80211_rx_DELBA(struct ieee80211_device *ieee, struct sk_buff *skb)
IEEE80211_DEBUG_DATA(IEEE80211_DL_DATA|IEEE80211_DL_BA, skb->data, skb->len);
delba = (struct rtl_80211_hdr_3addr *)skb->data;
dst = (u8 *)(&delba->addr2[0]);
delba += sizeof(struct rtl_80211_hdr_3addr);
pDelBaParamSet = (PDELBA_PARAM_SET)(delba+2);
pReasonCode = (u16 *)(delba+4);
pDelBaParamSet = (PDELBA_PARAM_SET)&delba->payload[2];
if(pDelBaParamSet->field.Initiator == 1)
{