Skip to contentSkip to conversation

potential bug in bnep_net_set_mc_list()

PATCH In review Dan Carpenter 4 participants 5 messages Jun 18, 2010 – Jun 25, 2010 1 message not in the archive

Subsystems (4)
Networking Network drivers Bluetooth drivers Bluetooth
lore
Share & tools
lore

Dan Carpenter

author
#0 lore raw

This is from ff6e2163f28a: "net: convert multiple drivers to use netdev_for_each_mc_addr, part7"

net/bluetooth/bnep/netdev.c
101 i = 0;
102 netdev_for_each_mc_addr(ha, dev) {
103 if (i == BNEP_MAX_MULTICAST_FILTERS)

                                ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
   104                                  break;
   105                          memcpy(__skb_put(skb, ETH_ALEN), ha->addr, ETH_ALEN);
   106                          memcpy(__skb_put(skb, ETH_ALEN), ha->addr, ETH_ALEN);
   107                  }

"i" is never incremented here so the check is always false.

regards,
dan carpenter

#1 lore raw

Hi Dan,

Quoted 14 lines · Dan Carpenter

This is from ff6e2163f28a: "net: convert multiple drivers to use netdev_for_each_mc_addr, part7"

net/bluetooth/bnep/netdev.c

   101                  i = 0;
   102                  netdev_for_each_mc_addr(ha, dev) {
   103                          if (i == BNEP_MAX_MULTICAST_FILTERS)
                                ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

   104                                  break;
   105                          memcpy(__skb_put(skb, ETH_ALEN), ha->addr, ETH_ALEN);
   106                          memcpy(__skb_put(skb, ETH_ALEN), ha->addr, ETH_ALEN);
   107                  }
Quoted 1 line

"i" is never incremented here so the check is always false.

Bring back the increment should fix this. I'll send a fix for this.

Signature · 2 lines
Gustavo F. Padovan
http://padovan.org
#2 lore raw

PATCH 1/1 Bluetooth: Bring back var 'i' increment

commit ff6e2163f28a1094fb5ca5950fe2b43c3cf6bc7a accidentally added a regression on the bnep code. Fixing it.

Signed-off-by Gustavo F. Padovan <[email protected]>
---
 net/bluetooth/bnep/netdev.c |    2 ++
 1 files changed, 2 insertions(+), 0 deletions(-)
net/bluetooth/bnep/netdev.c +2 -0
index 0faad5c..8c100c9 100644
@@ -104,6 +104,8 @@ static void bnep_net_set_mc_list(struct net_device *dev)
 				break;
 			memcpy(__skb_put(skb, ETH_ALEN), ha->addr, ETH_ALEN);
 			memcpy(__skb_put(skb, ETH_ALEN), ha->addr, ETH_ALEN);
+
+			i++;
 		}
 		r->len = htons(skb->len - len);
 	}
Signature · 1 line
1.6.4.4

A message that is not in the archive (sent off-list or not yet received): 1276907040-23229-1-git-send-email-padovan-Y3ZbgMPKUGA34EUeqzHoZw@public.gmane.org

#4 lore raw

Re: [PATCH] Bluetooth: Bring back var 'i' increment

Quoted 14 lines · Gustavo F. Padovan

commit ff6e2163f28a1094fb5ca5950fe2b43c3cf6bc7a accidentally added a regression on the bnep code. Fixing it.

Signed-off-by Gustavo F. Padovan <[email protected]>
---
 net/bluetooth/bnep/netdev.c |    2 ++
 1 files changed, 2 insertions(+), 0 deletions(-)
net/bluetooth/bnep/netdev.c +0 -0
index 0faad5c..8c100c9 100644

net/bluetooth/bnep/netdev.c static void bnep_net_set_mc_list(struct net_device *dev) · line 111

Quoted 8 lines
net/bluetooth/bnep/netdev.c +2 -0
@@ -104,6 +104,8 @@ static void bnep_net_set_mc_list(struct net_device *dev)
 				break;
 			memcpy(__skb_put(skb, ETH_ALEN), ha->addr, ETH_ALEN);
 			memcpy(__skb_put(skb, ETH_ALEN), ha->addr, ETH_ALEN);
+
+			i++;
 		}
 		r->len = htons(skb->len - len);
 	}

Marcel, if you want I can carry the fix on my tree for -next.

Signature · 2 lines
Gustavo F. Padovan
http://padovan.org
#5 lore raw

Re: [PATCH] Bluetooth: Bring back var 'i' increment

From: "Gustavo F. Padovan" <[email protected]>
Date: Fri, 18 Jun 2010 21:28:07 -0300

Quoted 6 lines · Gustavo F. Padovan
Quoted 5 lines

commit ff6e2163f28a1094fb5ca5950fe2b43c3cf6bc7a accidentally added a regression on the bnep code. Fixing it.

Signed-off-by Gustavo F. Padovan <[email protected]>

...

Quoted 1 line

Marcel, if you want I can carry the fix on my tree for -next.

I'll apply this bug fix to net-2.6 so it doesn't just rot like it is currently.

Thanks.