Skip to contentSkip to conversation

Hostap: copying wrong data prism2_ioctl_giwaplist()

PATCH In review Dan Carpenter 2 participants 2 messages Aug 9, 2013

Subsystems (2)
lore
Share & tools
lore
#0 lore raw

PATCH 1/1 Hostap: copying wrong data prism2_ioctl_giwaplist()

We want the data stored in "addr" and "qual", but the extra ampersands mean we are copying stack data instead.

---
Static checker stuff. Untested. Should probably be applied to -stable as well.

drivers/net/wireless/hostap/hostap_ioctl.c +2 -2
index ac07473..e509030 100644
@@ -523,9 +523,9 @@ static int prism2_ioctl_giwaplist(struct net_device *dev,
 
 	data->length = prism2_ap_get_sta_qual(local, addr, qual, IW_MAX_AP, 1);
 
-	memcpy(extra, &addr, sizeof(struct sockaddr) * data->length);
+	memcpy(extra, addr, sizeof(struct sockaddr) * data->length);
 	data->flags = 1; /* has quality information */
-	memcpy(extra + sizeof(struct sockaddr) * data->length, &qual,
+	memcpy(extra + sizeof(struct sockaddr) * data->length, qual,
 	       sizeof(struct iw_quality) * data->length);
 
 	kfree(addr);
#1 lore raw

Here I must insert the obligatory question:

Does anyone actually still use the hostap driver??

John

Quoted 25 lines · Dan Carpenter

We want the data stored in "addr" and "qual", but the extra ampersands mean we are copying stack data instead.

---
Static checker stuff. Untested. Should probably be applied to -stable as well.

drivers/net/wireless/hostap/hostap_ioctl.c +2 -2
index ac07473..e509030 100644
@@ -523,9 +523,9 @@ static int prism2_ioctl_giwaplist(struct net_device *dev,
 
 	data->length = prism2_ap_get_sta_qual(local, addr, qual, IW_MAX_AP, 1);
 
-	memcpy(extra, &addr, sizeof(struct sockaddr) * data->length);
+	memcpy(extra, addr, sizeof(struct sockaddr) * data->length);
 	data->flags = 1; /* has quality information */
-	memcpy(extra + sizeof(struct sockaddr) * data->length, &qual,
+	memcpy(extra + sizeof(struct sockaddr) * data->length, qual,
 	       sizeof(struct iw_quality) * data->length);
 
 	kfree(addr);
Signature · 2 lines
John W. Linville		Someday the world will need a hero, and you
[email protected]			might be all we have.  Be ready.