mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-08-27 19:29:37 +00:00
![]() The "u16 CcxRmState[2];" array field in struct "rtllib_network" has 4 bytes in total while the operations performed on this array through-out the code base are only 2 bytes. The "CcxRmState" field is fed only 2 bytes of data using memcpy(): (In rtllib_rx.c:1972) memcpy(network->CcxRmState, &info_element->data[4], 2) With "info_element->data[]" being a u8 array, if 2 bytes are written into "CcxRmState" (whose one element is u16 size), then the 2 u8 elements from "data[]" gets squashed and written into the first element ("CcxRmState[0]") while the second element ("CcxRmState[1]") is never fed with any data. Same in file rtllib_rx.c:2522: memcpy(dst->CcxRmState, src->CcxRmState, 2); The above line duplicates "src" data to "dst" but only writes 2 bytes (and not 4, which is the actual size). Again, only 1st element gets the value while the 2nd element remains uninitialized. This later makes operations done with CcxRmState unpredictable in the following lines as the 1st element is having a squashed number while the 2nd element is having an uninitialized random number. rtllib_rx.c:1973: if (network->CcxRmState[0] != 0) rtllib_rx.c:1977: network->MBssidMask = network->CcxRmState[1] & 0x07; network->MBssidMask is also of type u8 and not u16. Fix this by changing the type of "CcxRmState" from u16 to u8 so that the data written into this array and read from it make sense and are not random values. NOTE: The wrong initialization of "CcxRmState" can be seen in the following commit: commit |
||
---|---|---|
.. | ||
android | ||
axis-fifo | ||
board | ||
clocking-wizard | ||
comedi | ||
emxx_udc | ||
fbtft | ||
fieldbus | ||
fsl-dpaa2 | ||
fwserial | ||
gasket | ||
gdm724x | ||
greybus | ||
gs_fpgaboot | ||
hikey9xx | ||
iio | ||
kpc2000 | ||
ks7010 | ||
media | ||
most | ||
mt7621-dma | ||
mt7621-dts | ||
mt7621-pci | ||
netlogic | ||
nvec | ||
octeon | ||
octeon-usb | ||
olpc_dcon | ||
pi433 | ||
qlge | ||
ralink-gdma | ||
rtl8188eu | ||
rtl8192e | ||
rtl8192u | ||
rtl8712 | ||
rtl8723bs | ||
rts5208 | ||
sm750fb | ||
unisys | ||
vc04_services | ||
vme | ||
vt6655 | ||
vt6656 | ||
wfx | ||
wimax | ||
wlan-ng | ||
Kconfig | ||
Makefile |