* [patch] mwifiex: memory corruption in mwifiex_tdls_add_vht_capab()
@ 2014-02-14 9:03 ` Dan Carpenter
0 siblings, 0 replies; 4+ messages in thread
From: Dan Carpenter @ 2014-02-14 9:03 UTC (permalink / raw)
To: Bing Zhao, Avinash Patil
Cc: John W. Linville, linux-wireless, kernel-janitors
There is a typo here because the names are confusingly similar. The
intent was sizeof(struct ieee80211_vht_cap) (size 12) but sizeof(struct
ieee80211_ht_cap) (size 32) was used.
Anway, it's cleaner to just specify the variable instead of the type.
Fixes: 5f6d5983394f ('mwifiex: add VHT support for TDLS')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
diff --git a/drivers/net/wireless/mwifiex/tdls.c b/drivers/net/wireless/mwifiex/tdls.c
index 5efd456af571..9d6849f60603 100644
--- a/drivers/net/wireless/mwifiex/tdls.c
+++ b/drivers/net/wireless/mwifiex/tdls.c
@@ -180,7 +180,7 @@ static int mwifiex_tdls_add_vht_capab(struct mwifiex_private *priv,
memset(&vht_cap, 0, sizeof(struct ieee80211_vht_cap));
mwifiex_fill_vht_cap_tlv(priv, &vht_cap, priv->curr_bss_params.band);
- memcpy(pos, &vht_cap, sizeof(struct ieee80211_ht_cap));
+ memcpy(pos, &vht_cap, sizeof(vht_cap));
return 0;
}
^ permalink raw reply related [flat|nested] 4+ messages in thread
* [patch] mwifiex: memory corruption in mwifiex_tdls_add_vht_capab()
@ 2014-02-14 9:03 ` Dan Carpenter
0 siblings, 0 replies; 4+ messages in thread
From: Dan Carpenter @ 2014-02-14 9:03 UTC (permalink / raw)
To: Bing Zhao, Avinash Patil
Cc: John W. Linville, linux-wireless, kernel-janitors
There is a typo here because the names are confusingly similar. The
intent was sizeof(struct ieee80211_vht_cap) (size 12) but sizeof(struct
ieee80211_ht_cap) (size 32) was used.
Anway, it's cleaner to just specify the variable instead of the type.
Fixes: 5f6d5983394f ('mwifiex: add VHT support for TDLS')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
diff --git a/drivers/net/wireless/mwifiex/tdls.c b/drivers/net/wireless/mwifiex/tdls.c
index 5efd456af571..9d6849f60603 100644
--- a/drivers/net/wireless/mwifiex/tdls.c
+++ b/drivers/net/wireless/mwifiex/tdls.c
@@ -180,7 +180,7 @@ static int mwifiex_tdls_add_vht_capab(struct mwifiex_private *priv,
memset(&vht_cap, 0, sizeof(struct ieee80211_vht_cap));
mwifiex_fill_vht_cap_tlv(priv, &vht_cap, priv->curr_bss_params.band);
- memcpy(pos, &vht_cap, sizeof(struct ieee80211_ht_cap));
+ memcpy(pos, &vht_cap, sizeof(vht_cap));
return 0;
}
^ permalink raw reply related [flat|nested] 4+ messages in thread
* RE: [patch] mwifiex: memory corruption in mwifiex_tdls_add_vht_capab()
2014-02-14 9:03 ` Dan Carpenter
@ 2014-02-15 3:02 ` Bing Zhao
-1 siblings, 0 replies; 4+ messages in thread
From: Bing Zhao @ 2014-02-15 3:02 UTC (permalink / raw)
To: Dan Carpenter, Avinash Patil
Cc: John W. Linville, linux-wireless, kernel-janitors
Hi Dan,
Thanks for the patch.
> There is a typo here because the names are confusingly similar. The
> intent was sizeof(struct ieee80211_vht_cap) (size 12) but sizeof(struct
> ieee80211_ht_cap) (size 32) was used.
>
> Anway, it's cleaner to just specify the variable instead of the type.
>
> Fixes: 5f6d5983394f ('mwifiex: add VHT support for TDLS')
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Bing Zhao <bzhao@marvell.com>
Thanks,
Bing
>
> diff --git a/drivers/net/wireless/mwifiex/tdls.c b/drivers/net/wireless/mwifiex/tdls.c
> index 5efd456af571..9d6849f60603 100644
> --- a/drivers/net/wireless/mwifiex/tdls.c
> +++ b/drivers/net/wireless/mwifiex/tdls.c
> @@ -180,7 +180,7 @@ static int mwifiex_tdls_add_vht_capab(struct mwifiex_private *priv,
> memset(&vht_cap, 0, sizeof(struct ieee80211_vht_cap));
>
> mwifiex_fill_vht_cap_tlv(priv, &vht_cap, priv->curr_bss_params.band);
> - memcpy(pos, &vht_cap, sizeof(struct ieee80211_ht_cap));
> + memcpy(pos, &vht_cap, sizeof(vht_cap));
>
> return 0;
> }
^ permalink raw reply [flat|nested] 4+ messages in thread
* RE: [patch] mwifiex: memory corruption in mwifiex_tdls_add_vht_capab()
@ 2014-02-15 3:02 ` Bing Zhao
0 siblings, 0 replies; 4+ messages in thread
From: Bing Zhao @ 2014-02-15 3:02 UTC (permalink / raw)
To: Dan Carpenter, Avinash Patil
Cc: John W. Linville, linux-wireless, kernel-janitors
Hi Dan,
Thanks for the patch.
> There is a typo here because the names are confusingly similar. The
> intent was sizeof(struct ieee80211_vht_cap) (size 12) but sizeof(struct
> ieee80211_ht_cap) (size 32) was used.
>
> Anway, it's cleaner to just specify the variable instead of the type.
>
> Fixes: 5f6d5983394f ('mwifiex: add VHT support for TDLS')
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Bing Zhao <bzhao@marvell.com>
Thanks,
Bing
>
> diff --git a/drivers/net/wireless/mwifiex/tdls.c b/drivers/net/wireless/mwifiex/tdls.c
> index 5efd456af571..9d6849f60603 100644
> --- a/drivers/net/wireless/mwifiex/tdls.c
> +++ b/drivers/net/wireless/mwifiex/tdls.c
> @@ -180,7 +180,7 @@ static int mwifiex_tdls_add_vht_capab(struct mwifiex_private *priv,
> memset(&vht_cap, 0, sizeof(struct ieee80211_vht_cap));
>
> mwifiex_fill_vht_cap_tlv(priv, &vht_cap, priv->curr_bss_params.band);
> - memcpy(pos, &vht_cap, sizeof(struct ieee80211_ht_cap));
> + memcpy(pos, &vht_cap, sizeof(vht_cap));
>
> return 0;
> }
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2014-02-15 3:02 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2014-02-14 9:03 [patch] mwifiex: memory corruption in mwifiex_tdls_add_vht_capab() Dan Carpenter
2014-02-14 9:03 ` Dan Carpenter
2014-02-15 3:02 ` Bing Zhao
2014-02-15 3:02 ` Bing Zhao
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.