[PATCH net-next] net: qualcomm: rmnet: fix two pointer math bugs

[PATCH net-next] net: qualcomm: rmnet: fix two pointer math bugs

[Dan Carpenter]

We recently changed these two pointers from void pointers to struct
pointers and it breaks the pointer math so now the "txphdr" points
beyond the end of the buffer.

Fixes: 56a967c4f7e5 ("net: qualcomm: rmnet: Remove some unneeded casts")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
 drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c b/drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c
index 3ee5c1a8b46e..3676976c875b 100644
--- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c
+++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c
@@ -168,7 +168,7 @@ static void rmnet_map_complement_ipv4_txporthdr_csum_field(struct iphdr *ip4h)
 	void *txphdr;
 	u16 *csum;
 
-	txphdr = ip4h + ip4h->ihl * 4;
+	txphdr = (void *)ip4h + ip4h->ihl * 4;
 
 	if (ip4h->protocol == IPPROTO_TCP || ip4h->protocol == IPPROTO_UDP) {
 		csum = (u16 *)rmnet_map_get_csum_field(ip4h->protocol, txphdr);
@@ -203,7 +203,7 @@ rmnet_map_complement_ipv6_txporthdr_csum_field(struct ipv6hdr *ip6h)
 	void *txphdr;
 	u16 *csum;
 
-	txphdr = ip6h + sizeof(struct ipv6hdr);
+	txphdr = ip6h + 1;
 
 	if (ip6h->nexthdr == IPPROTO_TCP || ip6h->nexthdr == IPPROTO_UDP) {
 		csum = (u16 *)rmnet_map_get_csum_field(ip6h->nexthdr, txphdr);
-- 
2.30.2

Re: [PATCH net-next] net: qualcomm: rmnet: fix two pointer math bugs

[subashab]

On 2021-06-19 07:52, Dan Carpenter wrote:
> We recently changed these two pointers from void pointers to struct
> pointers and it breaks the pointer math so now the "txphdr" points
> beyond the end of the buffer.
> 
> Fixes: 56a967c4f7e5 ("net: qualcomm: rmnet: Remove some unneeded 
> casts")
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> ---
>  drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c
> b/drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c
> index 3ee5c1a8b46e..3676976c875b 100644
> --- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c
> +++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c
> @@ -168,7 +168,7 @@ static void
> rmnet_map_complement_ipv4_txporthdr_csum_field(struct iphdr *ip4h)
>  	void *txphdr;
>  	u16 *csum;
> 
> -	txphdr = ip4h + ip4h->ihl * 4;
> +	txphdr = (void *)ip4h + ip4h->ihl * 4;
> 
>  	if (ip4h->protocol == IPPROTO_TCP || ip4h->protocol == IPPROTO_UDP) {
>  		csum = (u16 *)rmnet_map_get_csum_field(ip4h->protocol, txphdr);
> @@ -203,7 +203,7 @@
> rmnet_map_complement_ipv6_txporthdr_csum_field(struct ipv6hdr *ip6h)
>  	void *txphdr;
>  	u16 *csum;
> 
> -	txphdr = ip6h + sizeof(struct ipv6hdr);
> +	txphdr = ip6h + 1;
> 
>  	if (ip6h->nexthdr == IPPROTO_TCP || ip6h->nexthdr == IPPROTO_UDP) {
>  		csum = (u16 *)rmnet_map_get_csum_field(ip6h->nexthdr, txphdr);

Hi Dan

Thanks for fixing this. Could you cast the ip4h to char* instead of 
void*.
Looks like gcc might raise issues if -Wpointer-arith is used.

https://gcc.gnu.org/onlinedocs/gcc-4.5.0/gcc/Pointer-Arith.html#Pointer-Arith

Re: [PATCH net-next] net: qualcomm: rmnet: fix two pointer math bugs

[Dan Carpenter]

On Sat, Jun 19, 2021 at 01:12:09PM -0600, subashab@codeaurora.org wrote:
> On 2021-06-19 07:52, Dan Carpenter wrote:
> 
> Hi Dan
> 
> Thanks for fixing this. Could you cast the ip4h to char* instead of void*.
> Looks like gcc might raise issues if -Wpointer-arith is used.
> 
> https://gcc.gnu.org/onlinedocs/gcc-4.5.0/gcc/Pointer-Arith.html#Pointer-Arith

The fix for that is to not enable -Wpointer-arith.  The warning is dumb.

regards,
dan carpenter

Re: [PATCH net-next] net: qualcomm: rmnet: fix two pointer math bugs

[Dan Carpenter]

On Mon, Jun 21, 2021 at 10:11:58AM +0300, Dan Carpenter wrote:
> On Sat, Jun 19, 2021 at 01:12:09PM -0600, subashab@codeaurora.org wrote:
> > On 2021-06-19 07:52, Dan Carpenter wrote:
> > 
> > Hi Dan
> > 
> > Thanks for fixing this. Could you cast the ip4h to char* instead of void*.
> > Looks like gcc might raise issues if -Wpointer-arith is used.
> > 
> > https://gcc.gnu.org/onlinedocs/gcc-4.5.0/gcc/Pointer-Arith.html#Pointer-Arith
> 
> The fix for that is to not enable -Wpointer-arith.  The warning is dumb.

Sorry, that was uncalled for and not correct.  The GCC warning would be
useful if we were trying to write portable userspace code.  But in the
kernel the kernel uses GCC extensions a lot.

The Clang compiler can also compile the kernel these days.  But it had
to add support for a bunch of GCC extensions to make that work.  Really
most of linux userspace is written with GCC in mind so Clang had to do
this anyway.

So we will never enable -Wpointer-arith in the kernel because there is
no need.

regards,
dan carpenter

Re: [PATCH net-next] net: qualcomm: rmnet: fix two pointer math bugs

[subashab]

On 2021-06-21 01:18, Dan Carpenter wrote:
> On Mon, Jun 21, 2021 at 10:11:58AM +0300, Dan Carpenter wrote:
>> On Sat, Jun 19, 2021 at 01:12:09PM -0600, subashab@codeaurora.org 
>> wrote:
>> > On 2021-06-19 07:52, Dan Carpenter wrote:
>> >
>> > Hi Dan
>> >
>> > Thanks for fixing this. Could you cast the ip4h to char* instead of void*.
>> > Looks like gcc might raise issues if -Wpointer-arith is used.
>> >
>> > https://gcc.gnu.org/onlinedocs/gcc-4.5.0/gcc/Pointer-Arith.html#Pointer-Arith
>> 
>> The fix for that is to not enable -Wpointer-arith.  The warning is 
>> dumb.
> 
> Sorry, that was uncalled for and not correct.  The GCC warning would be
> useful if we were trying to write portable userspace code.  But in the
> kernel the kernel uses GCC extensions a lot.
> 
> The Clang compiler can also compile the kernel these days.  But it had
> to add support for a bunch of GCC extensions to make that work.  Really
> most of linux userspace is written with GCC in mind so Clang had to do
> this anyway.
> 
> So we will never enable -Wpointer-arith in the kernel because there is
> no need.
> 
> regards,
> dan carpenter

Thanks for the clarification.

Reviewed-by: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>

Re: [PATCH net-next] net: qualcomm: rmnet: fix two pointer math bugs

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net-next.git (refs/heads/master):

On Sat, 19 Jun 2021 16:52:22 +0300 you wrote:
> We recently changed these two pointers from void pointers to struct
> pointers and it breaks the pointer math so now the "txphdr" points
> beyond the end of the buffer.
> 
> Fixes: 56a967c4f7e5 ("net: qualcomm: rmnet: Remove some unneeded casts")
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> 
> [...]

Here is the summary with links:
  - [net-next] net: qualcomm: rmnet: fix two pointer math bugs
    https://git.kernel.org/netdev/net-next/c/753ba09aa3ea

You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html