linux-kernel - [PATCH 2/2] staging: rtl8192e: Change state information from u16 to u8

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20210220182154.9457-2-atulgopinathan@gmail.com>
Date:   Sat, 20 Feb 2021 23:51:55 +0530
From:   Atul Gopinathan <atulgopinathan@...il.com>
To:     gregkh@...uxfoundation.org
Cc:     gustavo@...eddedor.com, tiwai@...e.de, devel@...verdev.osuosl.org,
        linux-kernel@...r.kernel.org,
        Atul Gopinathan <atulgopinathan@...il.com>
Subject: [PATCH 2/2] staging: rtl8192e: Change state information from u16 to u8

The "CcxRmState" field in struct "rtllib_network" is defined
as a u16 array of size 2 (so, 4 bytes in total).

But the operations performed on this array throughout the code
base (in rtl8192e/) are all in byte size 2 indicating that this
array's type was defined wrongly.

There are two situation were u16 type of this field could yield
incorrect behaviour:

1. In rtllib_rx.c:1970:
memcpy(network->CcxRmState, &info_element->data[4], 2);

Here last 2 bytes (index 4 and 5) from the info_element->data[]
array are meant to be copied into CcxRmState[].
Note that "data" array here is an array of type u8.

2. In function "update_network()" in staging/rtl8192e/rtllib_rx.c:
memcpy(dst->CcxRmState, src->CcxRmState, 2);

Here again, only 2 bytes are copied from the source state to
destination state.

There are no instances of "CcxRmState" requiring u16 data type.
Here is the output of "grep -IRn 'CcxRmState'" on the rtl8192e/
directory for reviewing:

rtllib_rx.c:1970:			memcpy(network->CcxRmState, &info_element->data[4], 2);
rtllib_rx.c:1971:			if (network->CcxRmState[0] != 0)
rtllib_rx.c:1975:			network->MBssidMask = network->CcxRmState[1] & 0x07;
rtllib_rx.c:2520:	memcpy(dst->CcxRmState, src->CcxRmState, 2);
rtllib.h:1108:	u8	CcxRmState[2];

//Note: The last line of output is my commit to this patch (u8 instead
of u16).

Signed-off-by: Atul Gopinathan <atulgopinathan@...il.com>
---
 drivers/staging/rtl8192e/rtllib.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/staging/rtl8192e/rtllib.h b/drivers/staging/rtl8192e/rtllib.h
index b84f00b8d18b..4cabaf21c1ca 100644
--- a/drivers/staging/rtl8192e/rtllib.h
+++ b/drivers/staging/rtl8192e/rtllib.h
@@ -1101,15 +1101,15 @@ struct rtllib_network {
 	u8 hidden_ssid[IW_ESSID_MAX_SIZE + 1];
 	u8 hidden_ssid_len;
 	struct rtllib_qos_data qos_data;

 	bool	bWithAironetIE;
 	bool	bCkipSupported;
 	bool	bCcxRmEnable;
-	u16	CcxRmState[2];
+	u8	CcxRmState[2];
 	bool	bMBssidValid;
 	u8	MBssidMask;
 	u8	MBssid[ETH_ALEN];
 	bool	bWithCcxVerNum;
 	u8	BssCcxVerNumber;
 	/* These are network statistics */
 	struct rtllib_rx_stats stats;
-- 
2.27.0