linux-kernel - Re: [PATCH V2] rtlwifi: rtl8192cu: Fix memset/memcpy using sizeof(ptr) not sizeof(*ptr)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <4DC84071.4080500@lwfinger.net>
Date:	Mon, 09 May 2011 14:28:49 -0500
From:	Larry Finger <Larry.Finger@...inger.net>
To:	Joe Perches <joe@...ches.com>
CC:	Chaoming Li <chaoming_li@...lsil.com.cn>,
	"John W. Linville" <linville@...driver.com>,
	linux-wireless@...r.kernel.org, netdev@...r.kernel.org,
	LKML <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH V2] rtlwifi: rtl8192cu: Fix memset/memcpy using sizeof(ptr)
 not sizeof(*ptr)

On 05/09/2011 12:09 PM, Joe Perches wrote:
> On Mon, 2011-05-09 at 11:02 -0500, Larry Finger wrote:
>> On 05/09/2011 12:43 AM, Joe Perches wrote:
>>> Found via coccinelle script
>>> @@
>>> type T;
>>> T* ptr;
>>> expression E1;
>>> @@
>>> * memset(E1, 0, sizeof(ptr));
>>> Signed-off-by: Joe Perches<joe@...ches.com>
>>> ---
>>>    drivers/net/wireless/rtlwifi/rtl8192cu/trx.c |    2 +-
>>>    1 files changed, 1 insertions(+), 1 deletions(-)
>>>
>>> diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/trx.c b/drivers/net/wireless/rtlwifi/rtl8192cu/trx.c
>>> @@ -372,7 +372,7 @@ static void _rtl_rx_process(struct ieee80211_hw *hw, struct sk_buff *skb)
> []
>>> +	memset(rx_status, 0, sizeof(*rx_status));
>> ACK.
>
> Hey Larry.
>
> If this is correct, then probably the memcpy at the
> end of the routine needs conversion too.
>
> ---
>
>   drivers/net/wireless/rtlwifi/rtl8192cu/trx.c |    4 ++--
>   1 files changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/trx.c b/drivers/net/wireless/rtlwifi/rtl8192cu/trx.c
> index 79c98f6..3a92ba3 100644
> --- a/drivers/net/wireless/rtlwifi/rtl8192cu/trx.c
> +++ b/drivers/net/wireless/rtlwifi/rtl8192cu/trx.c
> @@ -372,7 +372,7 @@ static void _rtl_rx_process(struct ieee80211_hw *hw, struct sk_buff *skb)
>   	__le16 fc;
>   	struct ieee80211_hdr *hdr;
>
> -	memset(rx_status, 0, sizeof(rx_status));
> +	memset(rx_status, 0, sizeof(*rx_status));
>   	rxdesc	= skb->data;
>   	skb_len	= skb->len;
>   	drvinfo_len = (GET_RX_DESC_DRVINFO_SIZE(rxdesc) * RTL_RX_DRV_INFO_UNIT);
> @@ -434,7 +434,7 @@ static void _rtl_rx_process(struct ieee80211_hw *hw, struct sk_buff *skb)
>   		 "0x%02X\n", fc, (u32)hdr->addr1[0], (u32)hdr->addr1[1],
>   		 (u32)hdr->addr1[2], (u32)hdr->addr1[3], (u32)hdr->addr1[4],
>   		 (u32)hdr->addr1[5]));
> -	memcpy(IEEE80211_SKB_RXCB(skb),&rx_status, sizeof(rx_status));
> +	memcpy(IEEE80211_SKB_RXCB(skb), rx_status, sizeof(*rx_status));
>   	ieee80211_rx_irqsafe(hw, skb);
>   }

Yes it does. After you posted V1 of the patch, I reviewed all the sizeof() calls 
in the rtlwifi tree and found the second one at line 437.

ACK for V2 once the commit message is fixed.

Larry
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/