linux-kernel - Re: [PATCH] staging: wilc1000: use kernel define byte order macros

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 22 Mar 2017 19:53:28 -0600
From:   Robert Perry Hooker <perry.hooker@...il.com>
To:     Dan Carpenter <dan.carpenter@...cle.com>
Cc:     devel@...verdev.osuosl.org, gregkh@...uxfoundation.org,
        ganesh.krishna@...rochip.com, linux-kernel@...r.kernel.org,
        aditya.shankar@...rochip.com
Subject: Re: [PATCH] staging: wilc1000: use kernel define byte order macros

I don't think buff is an ieee80211_hdr struct. I think it's the rx_buffer allocated at wilc_wlan.c:1417.

Regards,
Perry

On Wed, 2017-03-22 at 12:24 +0300, Dan Carpenter wrote:
> On Tue, Mar 21, 2017 at 03:40:10PM -0600, Robert Perry Hooker wrote:
> > Thanks for taking a look, Dan. Sorry if I missed the mark here.
> > 
> > Can you tell me a bit more about the bug this would introduce?
> > 
> > I see that ieee80211_is_action is defined like this: static inline bool ieee80211_is_action(__le16 fc)
> > 
> > ...and that buff[FRAME_TYPE_ID]is a u8 (since FRAME_TYPE_ID = 0).
> > 
> > Is there an issue with calling cpu_to_le16 on a u8 that isn't encountered by implicitly casting a u8 to __le16? Or 
> > am I
> > missing something else?
> > 
> 
> Oh...  Hm.  You're right.  I just was thinking that since buff was a
> little endian buffer but it's only reading a u8.  It should probably
> be reading a le16...  The buff likely is just a regular ieee80211_hdr
> struct.
> 
> So you're fixing a bug, but probably not in the right way.  We should
> instead just say "struct ieee80211_hdr *hdr = buff;" and instead of
> treating it like an array of u8.  Probably it requires testing...
> 
> regards,
> dan carpenter
>