From d0dcaa8d4eff40b2999d5265f2218c29e82e24cc Mon Sep 17 00:00:00 2001 From: Dan Carpenter Date: Sun, 19 Jul 2015 13:52:33 +0300 Subject: [PATCH] Staging: rtl8192e: pointer math bug in rtllib_rx_DELBA() The pointer math here was totally wrong so we were reading nonsense information from beyond the end of the buffer. It could lead to an oops if that memory wasn't mapped. The "pReasonCode" pointer is assigned but never used so I deleted it. With-Fix-From: Mateusz Kulikowski Signed-off-by: Dan Carpenter Acked-by: Mateusz Kulikowski Tested-by: Mateusz Kulikowski Signed-off-by: Greg Kroah-Hartman --- drivers/staging/rtl8192e/rtl819x_BAProc.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/drivers/staging/rtl8192e/rtl819x_BAProc.c b/drivers/staging/rtl8192e/rtl819x_BAProc.c index 60f536c295ab..78ede4a817fc 100644 --- a/drivers/staging/rtl8192e/rtl819x_BAProc.c +++ b/drivers/staging/rtl8192e/rtl819x_BAProc.c @@ -428,7 +428,6 @@ int rtllib_rx_DELBA(struct rtllib_device *ieee, struct sk_buff *skb) { struct rtllib_hdr_3addr *delba = NULL; union delba_param_set *pDelBaParamSet = NULL; - u16 *pReasonCode = NULL; u8 *dst = NULL; if (skb->len < sizeof(struct rtllib_hdr_3addr) + 6) { @@ -453,9 +452,7 @@ int rtllib_rx_DELBA(struct rtllib_device *ieee, struct sk_buff *skb) #endif delba = (struct rtllib_hdr_3addr *)skb->data; dst = (u8 *)(&delba->addr2[0]); - delba += sizeof(struct rtllib_hdr_3addr); - pDelBaParamSet = (union delba_param_set *)(delba+2); - pReasonCode = (u16 *)(delba+4); + pDelBaParamSet = (union delba_param_set *)&delba->payload[2]; if (pDelBaParamSet->field.Initiator == 1) { struct rx_ts_record *pRxTs; -- 2.39.2