lkml.org 
[lkml]   [2012]   [Jul]   [16]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
From
Subject[PATCH] wl12xx: Fix for overflow while getting irq status
Date
From: Manjunatha Halli <x0130808@ti.com>

->dlen is 8 bit long and so while memcpy there is a chance
that fmdev->irq_info.flag will overflow.

So this patch removes memcpy and instead copies the 16bit flag
register value from skb->data to fmdev->irq_info.flag directly.

Change-Id: I37604b91b2777ed9e56a7e1c1ecefe32e9024170
Signed-off-by: Manjunatha Halli <x0130808@ti.com>
---
drivers/media/radio/wl128x/fmdrv_common.c | 8 +++-----
1 files changed, 3 insertions(+), 5 deletions(-)

diff --git a/drivers/media/radio/wl128x/fmdrv_common.c b/drivers/media/radio/wl128x/fmdrv_common.c
index bf867a6..54c549b 100644
--- a/drivers/media/radio/wl128x/fmdrv_common.c
+++ b/drivers/media/radio/wl128x/fmdrv_common.c
@@ -584,18 +584,16 @@ static void fm_irq_send_flag_getcmd(struct fmdev *fmdev)
static void fm_irq_handle_flag_getcmd_resp(struct fmdev *fmdev)
{
struct sk_buff *skb;
- struct fm_event_msg_hdr *fm_evt_hdr;

if (check_cmdresp_status(fmdev, &skb))
return;

- fm_evt_hdr = (void *)skb->data;
-
/* Skip header info and copy only response data */
skb_pull(skb, sizeof(struct fm_event_msg_hdr));
- memcpy(&fmdev->irq_info.flag, skb->data, fm_evt_hdr->dlen);

- fmdev->irq_info.flag = be16_to_cpu(fmdev->irq_info.flag);
+ /* Copy 16 bit flag register value from skb->data */
+ fmdev->irq_info.flag = (u16) ((skb->data[0] << 8) | skb->data[1]);
+
fmdbg("irq: flag register(0x%x)\n", fmdev->irq_info.flag);

/* Continue next function in interrupt handler table */
--
1.7.4.1


\
 
 \ /
  Last update: 2012-07-16 21:41    [W:0.049 / U:0.220 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site