Date: Sat, 10 Apr 2004 10:20:40 +0200
From: Jean Delvare <khali@linux-fr.org>
To: LKML <linux-kernel@vger.kernel.org>
Cc: Alfred Arnold <aarnold@elsa.de>
Subject: [BUG 2.2/2.4/2.6] broken memsets in net/sk_mca.c (multicast)
Message-Id: <20040410102040.022ffb3c.khali@linux-fr.org>
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Sender: linux-kernel-owner@vger.kernel.org
Content-Length: 1457
Lines: 48

[Please CC: me on reply, I'm not subscribed (yet)]

Hi all,

I just found two very weird memsets in drivers/net/sk_mca.c. I am not
working on that driver at all, but some grepping of the kernel source
pointed me to it so I thought I wouldn't keep quiet about it.

Here is the offending code:

static void skmca_set_multicast_list(struct net_device *dev)
{
	(...)
	if (dev->flags & IFF_ALLMULTI) {	/* get all multicasts */
		memset(block.LAdrF, 8, 0xff);
	} else {		/* get selected/no multicasts */
		(...)
		memset(block.LAdrF, 8, 0x00);
		(...)
	}
	(...)
}

Is it just me, or are these two memsets just plain broken? Not only the
size is hardcoded, but the parameters are swapped! I guess that this
driver never worked in multicast mode. The correct memsets are
obviously:
		memset(block.LAdrF, 0xff, sizeof(block.LAdrF));
and
		memset(block.LAdrF, 0x00, sizeof(block.LAdrF));
respectively.

The odd thing is that the bug is there since the driver was introduced
in the 2.2.10 kernel. So, 2.2, 2.4 and 2.6 kernels are all affected.

I admit I'm a bit surprized that this could survive until today, so just
tell me if it's me missing the point ;)

Thanks.

-- 
Jean Delvare
http://www.ensicaen.ismra.fr/~delvare/
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/