lkml.org 
[lkml]   [2016]   [Sep]   [30]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: [PATCH 2/2] staging: vt6656: Make 'rx_rate' u8 instead of u8 *
From
Date
On 28/09/16 08:40, Dan Carpenter wrote:
> On Tue, Sep 27, 2016 at 02:52:49PM -0300, Martin Alonso wrote:
>> Change the type and uses of rx_rate.
>>
>> Signed-off-by: Martin Alonso <martin.alonso@zoho.com>
>> ---
>> drivers/staging/vt6656/dpc.c | 9 +++++----
>> 1 file changed, 5 insertions(+), 4 deletions(-)
>>
>> diff --git a/drivers/staging/vt6656/dpc.c b/drivers/staging/vt6656/dpc.c
>> index 655f000..782b7d7 100644
>> --- a/drivers/staging/vt6656/dpc.c
>> +++ b/drivers/staging/vt6656/dpc.c
>> @@ -46,7 +46,8 @@ int vnt_rx_data(struct vnt_private *priv, struct vnt_rcb *ptr_rcb,
>> __le64 *tsf_time;
>> u32 frame_size;
>> int ii, r;
>> - u8 *rx_rate, *sq, *sq_3;
>> + u8 rx_rate;
>> + u8 *sq, *sq_3;
>> u32 wbk_status;
>> u8 *skb_data;
>> u16 *pay_load_len;
>> @@ -75,7 +76,7 @@ int vnt_rx_data(struct vnt_private *priv, struct vnt_rcb *ptr_rcb,
>>
>> skb_data = (u8 *)skb->data;
>>
>> - rx_rate = skb_data + 5;
>> + rx_rate = *(skb_data + 5);
>
> It occurs to me that we don't check that skb->len is large enough here.
> We just assume it has at least 5 bytes.
>
> TODO: vt6656: verify skb->len before using it.

skb->len is always set to the tail room then trimmed by this function.

Regards

Malcolm
































\
 
 \ /
  Last update: 2016-09-30 20:53    [W:0.082 / U:0.192 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site