Hostap: copying wrong data prism2_ioctl_giwaplist()
Subsystems (2)
PATCH 1/1 Hostap: copying wrong data prism2_ioctl_giwaplist()
We want the data stored in "addr" and "qual", but the extra ampersands mean we are copying stack data instead.
Signed-off-by Dan Carpenter <[email protected]>
---
Static checker stuff. Untested. Should probably be applied to -stable as well.
drivers/net/wireless/hostap/hostap_ioctl.c +2 -2
@@ -523,9 +523,9 @@ static int prism2_ioctl_giwaplist(struct net_device *dev, data->length =prism2_ap_get_sta_qual (local, addr, qual,IW_MAX_AP ,1 ); -memcpy (extra, &addr,sizeof (struct sockaddr ) * data->length); +memcpy (extra, addr,sizeof (struct sockaddr ) * data->length); data->flags =1 ;/* has quality information */ -memcpy (extra +sizeof (struct sockaddr ) * data->length, &qual, +memcpy (extra +sizeof (struct sockaddr ) * data->length, qual,sizeof (struct iw_quality ) * data->length);kfree (addr);
Here I must insert the obligatory question:
Does anyone actually still use the hostap driver??
John
Quoted 25 lines · Dan Carpenter
We want the data stored in "addr" and "qual", but the extra ampersands mean we are copying stack data instead.
Signed-off-by Dan Carpenter <[email protected]>---
Static checker stuff. Untested. Should probably be applied to -stable as well.drivers/net/wireless/hostap/hostap_ioctl.c +2
-2@@ -523,9 +523,9 @@ static int prism2_ioctl_giwaplist(struct net_device *dev, data->length =prism2_ap_get_sta_qual (local, addr, qual,IW_MAX_AP ,1 ); -memcpy (extra, &addr,sizeof (struct sockaddr ) * data->length); +memcpy (extra, addr,sizeof (struct sockaddr ) * data->length); data->flags =1 ;/* has quality information */ -memcpy (extra +sizeof (struct sockaddr ) * data->length, &qual, +memcpy (extra +sizeof (struct sockaddr ) * data->length, qual,sizeof (struct iw_quality ) * data->length);kfree (addr);
Signature · 2 lines
John W. Linville Someday the world will need a hero, and you [email protected] might be all we have. Be ready.