From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751454AbcI1HlB (ORCPT ); Wed, 28 Sep 2016 03:41:01 -0400 Received: from aserp1040.oracle.com ([141.146.126.69]:51119 "EHLO aserp1040.oracle.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750793AbcI1Hkw (ORCPT ); Wed, 28 Sep 2016 03:40:52 -0400 Date: Wed, 28 Sep 2016 10:40:29 +0300 From: Dan Carpenter To: Martin Alonso Cc: joe@perches.com, forest@alittletooquiet.net, gregkh@linuxfoundation.org, pasteka@kabsi.at, devel@driverdev.osuosl.org, linux-kernel@vger.kernel.org Subject: Re: [PATCH 2/2] staging: vt6656: Make 'rx_rate' u8 instead of u8 * Message-ID: <20160928074029.GA13620@mwanda> References: <20160927165901.GA28955@malonso-pc> <1474998769-29646-1-git-send-email-martin.alonso@zoho.com> <1474998769-29646-2-git-send-email-martin.alonso@zoho.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <1474998769-29646-2-git-send-email-martin.alonso@zoho.com> User-Agent: Mutt/1.5.21 (2010-09-15) X-Source-IP: aserv0021.oracle.com [141.146.126.233] Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Tue, Sep 27, 2016 at 02:52:49PM -0300, Martin Alonso wrote: > Change the type and uses of rx_rate. > > Signed-off-by: Martin Alonso > --- > drivers/staging/vt6656/dpc.c | 9 +++++---- > 1 file changed, 5 insertions(+), 4 deletions(-) > > diff --git a/drivers/staging/vt6656/dpc.c b/drivers/staging/vt6656/dpc.c > index 655f000..782b7d7 100644 > --- a/drivers/staging/vt6656/dpc.c > +++ b/drivers/staging/vt6656/dpc.c > @@ -46,7 +46,8 @@ int vnt_rx_data(struct vnt_private *priv, struct vnt_rcb *ptr_rcb, > __le64 *tsf_time; > u32 frame_size; > int ii, r; > - u8 *rx_rate, *sq, *sq_3; > + u8 rx_rate; > + u8 *sq, *sq_3; > u32 wbk_status; > u8 *skb_data; > u16 *pay_load_len; > @@ -75,7 +76,7 @@ int vnt_rx_data(struct vnt_private *priv, struct vnt_rcb *ptr_rcb, > > skb_data = (u8 *)skb->data; > > - rx_rate = skb_data + 5; > + rx_rate = *(skb_data + 5); It occurs to me that we don't check that skb->len is large enough here. We just assume it has at least 5 bytes. TODO: vt6656: verify skb->len before using it. regards, dan carpenter