Return-path: Received: from mail-gw2-out.broadcom.com ([216.31.210.63]:34274 "EHLO mail-gw2-out.broadcom.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1756627AbcISLKZ (ORCPT ); Mon, 19 Sep 2016 07:10:25 -0400 From: Arend van Spriel To: Kalle Valo Cc: linux-wireless , Hante Meuleman , Arend van Spriel Subject: [PATCH 7/9] brcmfmac: fix clearing entry IPv6 address Date: Mon, 19 Sep 2016 12:09:57 +0100 Message-Id: <1474283399-14385-8-git-send-email-arend.vanspriel@broadcom.com> (sfid-20160919_131042_113373_21566E3F) In-Reply-To: <1474283399-14385-1-git-send-email-arend.vanspriel@broadcom.com> References: <1474283399-14385-1-git-send-email-arend.vanspriel@broadcom.com> Sender: linux-wireless-owner@vger.kernel.org List-ID: From: Hante Meuleman When IPv6 address is to be cleared there is a possible out of bound access. But also the clearing of the last entry and the adjustment of total number of stored IPv6 addresses is not updated. This patch fixes that bug. Bug was found using coverity. Reviewed-by: Arend Van Spriel Reviewed-by: Franky Lin Reviewed-by: Pieter-Paul Giesberts Signed-off-by: Hante Meuleman Signed-off-by: Arend van Spriel --- drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c index 3394184..bb71199 100644 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c @@ -873,9 +873,12 @@ static int brcmf_inet6addr_changed(struct notifier_block *nb, } break; case NETDEV_DOWN: - if (i < NDOL_MAX_ENTRIES) - for (; i < ifp->ipv6addr_idx; i++) + if (i < NDOL_MAX_ENTRIES) { + for (; i < ifp->ipv6addr_idx - 1; i++) table[i] = table[i + 1]; + memset(&table[i], 0, sizeof(table[i])); + ifp->ipv6addr_idx--; + } break; default: break; -- 1.9.1