lkml.org 
[lkml]   [2020]   [May]   [8]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
From
Subject[PATCH 4.4 004/312] staging: rtl8192u: Fix crash due to pointers being "confusing"
Date
From: Ben Hutchings <ben@decadent.org.uk>

commit c3f463484bdd0acd15abd5f92399041f79592d06 upstream.

There's no net_device stashed in skb->cb, there's a net_device * there.

To make it *really* clear, also change the write of the dev pointer
into skb->cb from a memcpy() to an assignment.

Fixes: 3fe563249374 ("staging: rtl8192u: r8192U_core.c: Cleaning up ...")
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
drivers/staging/rtl8192u/r8192U_core.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)

--- a/drivers/staging/rtl8192u/r8192U_core.c
+++ b/drivers/staging/rtl8192u/r8192U_core.c
@@ -1050,7 +1050,7 @@ static void rtl8192_hard_data_xmit(struc

spin_lock_irqsave(&priv->tx_lock, flags);

- memcpy((unsigned char *)(skb->cb), &dev, sizeof(dev));
+ *(struct net_device **)(skb->cb) = dev;
tcb_desc->bTxEnableFwCalcDur = 1;
skb_push(skb, priv->ieee80211->tx_headroom);
ret = rtl8192_tx(dev, skb);
@@ -1092,7 +1092,7 @@ static int rtl8192_hard_start_xmit(struc
static void rtl8192_tx_isr(struct urb *tx_urb)
{
struct sk_buff *skb = (struct sk_buff *)tx_urb->context;
- struct net_device *dev = (struct net_device *)(skb->cb);
+ struct net_device *dev = *(struct net_device **)(skb->cb);
struct r8192_priv *priv = NULL;
cb_desc *tcb_desc = (cb_desc *)(skb->cb + MAX_DEV_ADDR_SIZE);
u8 queue_index = tcb_desc->queue_index;

\
 
 \ /
  Last update: 2020-05-08 15:27    [W:1.903 / U:0.168 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site