From: Atul Gopinathan <atulgopinathan@gmail.com> To: gregkh@linuxfoundation.org Cc: gustavo@embeddedor.com, tiwai@suse.de, devel@driverdev.osuosl.org, linux-kernel@vger.kernel.org, Atul Gopinathan <atulgopinathan@gmail.com> Subject: [PATCH 1/2] staging: rtl8192e: Pass array value to memcpy instead of struct pointer Date: Sat, 20 Feb 2021 23:51:53 +0530 [thread overview] Message-ID: <20210220182154.9457-1-atulgopinathan@gmail.com> (raw) The variable "info_element" is of the following type: struct rtllib_info_element *info_element rtllib_info_element is a struct containing the following fields as defined in drivers/staging/rtl8192e/rtllib.h: struct rtllib_info_element { u8 id; u8 len; u8 data[]; } __packed; The following code of interest (to which this patch applies) is supposed to check if the "info_element->len" is greater than 4 and equal to 6, if this is satisfied then, the last two bytes (the 4th and 5th index of u8 "data" array) are copied into "network->CcxRmState". Currently the code uses "memcpy()" with the source as "&info_element[4]" which would copy in wrong and unintended information. This patch rectifies this error by using "&info_element->data[4]" which rightly copies the last two bytes as the required state information. Signed-off-by: Atul Gopinathan <atulgopinathan@gmail.com> --- drivers/staging/rtl8192e/rtllib_rx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/staging/rtl8192e/rtllib_rx.c b/drivers/staging/rtl8192e/rtllib_rx.c index 66c135321da4..15bbb63ca130 100644 --- a/drivers/staging/rtl8192e/rtllib_rx.c +++ b/drivers/staging/rtl8192e/rtllib_rx.c @@ -1963,15 +1963,15 @@ static void rtllib_parse_mife_generic(struct rtllib_device *ieee, if (info_element->len > 4 && info_element->data[0] == 0x00 && info_element->data[1] == 0x40 && info_element->data[2] == 0x96 && info_element->data[3] == 0x01) { if (info_element->len == 6) { - memcpy(network->CcxRmState, &info_element[4], 2); + memcpy(network->CcxRmState, &info_element->data[4], 2); if (network->CcxRmState[0] != 0) network->bCcxRmEnable = true; else network->bCcxRmEnable = false; network->MBssidMask = network->CcxRmState[1] & 0x07; if (network->MBssidMask != 0) { network->bMBssidValid = true; -- 2.27.0
WARNING: multiple messages have this Message-ID (diff)
From: Atul Gopinathan <atulgopinathan@gmail.com> To: gregkh@linuxfoundation.org Cc: tiwai@suse.de, devel@driverdev.osuosl.org, Atul Gopinathan <atulgopinathan@gmail.com>, linux-kernel@vger.kernel.org, gustavo@embeddedor.com Subject: [PATCH 1/2] staging: rtl8192e: Pass array value to memcpy instead of struct pointer Date: Sat, 20 Feb 2021 23:51:53 +0530 [thread overview] Message-ID: <20210220182154.9457-1-atulgopinathan@gmail.com> (raw) The variable "info_element" is of the following type: struct rtllib_info_element *info_element rtllib_info_element is a struct containing the following fields as defined in drivers/staging/rtl8192e/rtllib.h: struct rtllib_info_element { u8 id; u8 len; u8 data[]; } __packed; The following code of interest (to which this patch applies) is supposed to check if the "info_element->len" is greater than 4 and equal to 6, if this is satisfied then, the last two bytes (the 4th and 5th index of u8 "data" array) are copied into "network->CcxRmState". Currently the code uses "memcpy()" with the source as "&info_element[4]" which would copy in wrong and unintended information. This patch rectifies this error by using "&info_element->data[4]" which rightly copies the last two bytes as the required state information. Signed-off-by: Atul Gopinathan <atulgopinathan@gmail.com> --- drivers/staging/rtl8192e/rtllib_rx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/staging/rtl8192e/rtllib_rx.c b/drivers/staging/rtl8192e/rtllib_rx.c index 66c135321da4..15bbb63ca130 100644 --- a/drivers/staging/rtl8192e/rtllib_rx.c +++ b/drivers/staging/rtl8192e/rtllib_rx.c @@ -1963,15 +1963,15 @@ static void rtllib_parse_mife_generic(struct rtllib_device *ieee, if (info_element->len > 4 && info_element->data[0] == 0x00 && info_element->data[1] == 0x40 && info_element->data[2] == 0x96 && info_element->data[3] == 0x01) { if (info_element->len == 6) { - memcpy(network->CcxRmState, &info_element[4], 2); + memcpy(network->CcxRmState, &info_element->data[4], 2); if (network->CcxRmState[0] != 0) network->bCcxRmEnable = true; else network->bCcxRmEnable = false; network->MBssidMask = network->CcxRmState[1] & 0x07; if (network->MBssidMask != 0) { network->bMBssidValid = true; -- 2.27.0 _______________________________________________ devel mailing list devel@linuxdriverproject.org http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel
next reply other threads:[~2021-02-20 18:23 UTC|newest] Thread overview: 19+ messages / expand[flat|nested] mbox.gz Atom feed top 2021-02-20 18:21 Atul Gopinathan [this message] 2021-02-20 18:21 ` [PATCH 1/2] staging: rtl8192e: Pass array value to memcpy instead of struct pointer Atul Gopinathan 2021-02-20 18:21 ` [PATCH 2/2] staging: rtl8192e: Change state information from u16 to u8 Atul Gopinathan 2021-02-20 18:21 ` Atul Gopinathan 2021-02-21 13:08 ` Greg KH 2021-02-21 13:08 ` Greg KH 2021-02-21 16:57 ` Atul Gopinathan 2021-02-21 16:57 ` Atul Gopinathan 2021-02-22 15:26 ` Greg KH 2021-02-22 15:26 ` Greg KH 2021-02-22 17:23 ` Atul Gopinathan 2021-02-22 17:23 ` Atul Gopinathan 2021-03-02 14:38 ` Greg KH 2021-03-02 14:38 ` Greg KH 2021-03-02 16:53 ` Atul Gopinathan 2021-03-02 16:53 ` Atul Gopinathan 2021-02-20 18:34 ` [PATCH 1/2] staging: rtl8192e: Pass array value to memcpy instead of struct pointer Gustavo A. R. Silva 2021-02-21 5:21 ` Atul Gopinathan 2021-02-21 5:21 ` Atul Gopinathan
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20210220182154.9457-1-atulgopinathan@gmail.com \ --to=atulgopinathan@gmail.com \ --cc=devel@driverdev.osuosl.org \ --cc=gregkh@linuxfoundation.org \ --cc=gustavo@embeddedor.com \ --cc=linux-kernel@vger.kernel.org \ --cc=tiwai@suse.de \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.