Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Date:   Sat, 31 Mar 2018 12:14:20 +0300
From:   Dan Carpenter <dan.carpenter@oracle.com>
To:     Quytelda Kahja <quytelda@tamalin.org>
Cc:     gregkh@linuxfoundation.org, wsa@the-dreams.de,
        devel@driverdev.osuosl.org, driverdev-devel@linuxdriverproject.org,
        linux-kernel@vger.kernel.org
Subject: Re: [PATCH v2 68/75] staging: ks7010: Replace manual array copy with
 ether_addr_copy().
Message-ID: <20180331091420.3gdpzy557j2g443d@mwanda>
References: <CAFLvi23=E6QubTGX0=cHjbJGB=Vx5OJ7d16E2R4HZTscmJuuSw@mail.gmail.com>
 <20180331060855.9452-1-quytelda@tamalin.org>
 <20180331060855.9452-68-quytelda@tamalin.org>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20180331060855.9452-68-quytelda@tamalin.org>
User-Agent: NeoMutt/20170609 (1.8.3)
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

I'm in a hurry because I'm leaving for a long weekend so I've reviewed
the first easy 67 patches but this one is tricky and I'm not able to
review it properly before I leave.

On Fri, Mar 30, 2018 at 11:08:48PM -0700, Quytelda Kahja wrote:
> Copying the dummy HW address into the struct net_device doesn't need
> to be done byte by byte; use ether_addr_copy() instead.

Fine.

> Additionally, dev->dev_addr is not eight bytes long.
> ether_setup() sets the dev->addr_len to ETH_ALEN (defined as 6)
> in the net core code.

So it's a buffer overflow?  The subject should have mentioned that this
is a bug fix.  But I'm not sure it is.  dev->dev_addr is MAX_ADDR_LEN (32)
bytes long I believe.  See dev_addr_init() for details.

The commit message didn't make it clear that you were getting rid of
priv->eth_addr.  It's a good change, but it confused me and I am in a
hurry.

> 
> Signed-off-by: Quytelda Kahja <quytelda@tamalin.org>
> ---
>  drivers/staging/ks7010/ks_hostif.c   | 29 +++++++++++------------------
>  drivers/staging/ks7010/ks_wlan.h     |  2 --
>  drivers/staging/ks7010/ks_wlan_net.c | 13 ++-----------
>  3 files changed, 13 insertions(+), 31 deletions(-)
> 
> diff --git a/drivers/staging/ks7010/ks_hostif.c b/drivers/staging/ks7010/ks_hostif.c
> index 1eff78540683..23c637ef147d 100644
> --- a/drivers/staging/ks7010/ks_hostif.c
> +++ b/drivers/staging/ks7010/ks_hostif.c
> @@ -388,6 +388,7 @@ int hostif_data_indication_wpa(struct ks_wlan_private *priv,
>  static
>  void hostif_data_indication(struct ks_wlan_private *priv)
>  {
> +	struct net_device *dev = priv->net_dev;
>  	unsigned int rx_ind_size;	/* indicate data size */
>  	struct sk_buff *skb;
>  	unsigned short auth_type;
> @@ -411,9 +412,9 @@ void hostif_data_indication(struct ks_wlan_private *priv)
>  	eth_proto = ntohs(eth_hdr->h_proto);
>  
>  	/* source address check */
> -	if (memcmp(&priv->eth_addr[0], eth_hdr->h_source, ETH_ALEN) == 0) {
> -		netdev_err(priv->net_dev, "invalid : source is own mac address !!\n");
> -		netdev_err(priv->net_dev,
> +	if (memcmp(dev->dev_addr, eth_hdr->h_source, ETH_ALEN) == 0) {
> +		netdev_err(dev, "invalid : source is own mac address !!\n");
> +		netdev_err(dev,
>  			   "eth_hdrernet->h_dest=%02X:%02X:%02X:%02X:%02X:%02X\n",
>  			   eth_hdr->h_source[0], eth_hdr->h_source[1],
>  			   eth_hdr->h_source[2], eth_hdr->h_source[3],
> @@ -443,7 +444,7 @@ void hostif_data_indication(struct ks_wlan_private *priv)
>  			priv->nstats.rx_dropped++;
>  			return;
>  		}
> -		netdev_dbg(priv->net_dev, "SNAP, rx_ind_size = %d\n",
> +		netdev_dbg(dev, "SNAP, rx_ind_size = %d\n",
>  			   rx_ind_size);

I don't like the printk cleanups.  They belong in a separate patch and
they make it harder for reviewers in a hurry to see what the patch is
doing.

Sorry, gotta run...

regards,
dan carpenter