Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753406AbbGSKu1 (ORCPT ); Sun, 19 Jul 2015 06:50:27 -0400 Received: from userp1040.oracle.com ([156.151.31.81]:19033 "EHLO userp1040.oracle.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752610AbbGSKuZ (ORCPT ); Sun, 19 Jul 2015 06:50:25 -0400 Date: Sun, 19 Jul 2015 13:52:33 +0300 From: Dan Carpenter To: Greg Kroah-Hartman Cc: Mateusz Kulikowski , Vaishali Thakkar , Mahati Chamarthy , Chen Gang , Matthew Casey , devel@driverdev.osuosl.org, linux-kernel@vger.kernel.org, kernel-janitors@vger.kernel.org Subject: [patch 2/2 v2] Staging: rtl8192e: pointer math bug in rtllib_rx_DELBA() Message-ID: <20150719105233.GB8410@mwanda> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <55A962E4.2070708@gmail.com> User-Agent: Mutt/1.5.23 (2014-03-12) X-Source-IP: userv0022.oracle.com [156.151.31.74] Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1646 Lines: 39 The pointer math here was totally wrong so we were reading nonsense information from beyond the end of the buffer. It could lead to an oops if that memory wasn't mapped. The "pReasonCode" pointer is assigned but never used so I deleted it. With-Fix-From: Mateusz Kulikowski Signed-off-by: Dan Carpenter --- v2: Mateusz noticed some more pointer math bugs on the next lines. diff --git a/drivers/staging/rtl8192e/rtl819x_BAProc.c b/drivers/staging/rtl8192e/rtl819x_BAProc.c index 60f536c..78ede4a 100644 --- a/drivers/staging/rtl8192e/rtl819x_BAProc.c +++ b/drivers/staging/rtl8192e/rtl819x_BAProc.c @@ -428,7 +428,6 @@ int rtllib_rx_DELBA(struct rtllib_device *ieee, struct sk_buff *skb) { struct rtllib_hdr_3addr *delba = NULL; union delba_param_set *pDelBaParamSet = NULL; - u16 *pReasonCode = NULL; u8 *dst = NULL; if (skb->len < sizeof(struct rtllib_hdr_3addr) + 6) { @@ -453,9 +452,7 @@ int rtllib_rx_DELBA(struct rtllib_device *ieee, struct sk_buff *skb) #endif delba = (struct rtllib_hdr_3addr *)skb->data; dst = (u8 *)(&delba->addr2[0]); - delba += sizeof(struct rtllib_hdr_3addr); - pDelBaParamSet = (union delba_param_set *)(delba+2); - pReasonCode = (u16 *)(delba+4); + pDelBaParamSet = (union delba_param_set *)&delba->payload[2]; if (pDelBaParamSet->field.Initiator == 1) { struct rx_ts_record *pRxTs; -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/