staging: r8188eu: Fix PPPoE tag insertion on little endian systems
PATCH v3 1/1 staging: r8188eu: Fix PPPoE tag insertion on little endian systems
In __nat25_add_pppoe_tag(), the tag length is read from the tag data structure. The value is kept in network format, but read as raw value. With -Warray-bounds, this results in the following gcc error/warning when building the driver on alpha.
In function '__nat25_add_pppoe_tag',
inlined from 'nat25_db_handle' at
drivers/staging/r8188eu/core/rtw_br_ext.c:479:11:arch/alpha/include/asm/string.h:22:16: error:
'__builtin_memcpy' forming offset [40, 2051] is out of the bounds [0, 40] of object 'tag_buf' with type 'unsigned char[40]'
Add the missing be16_to_cpu() to fix the compile error. It should be noted, however, that this fix means that the code did probably not work on any little endian systems and/or that the driver has other endiannes related issues. A build with C=1 suggests that this is indeed the case. This patch does not attempt to fix any of those other issues.
---
v3: alpha is little endian, not big endian. Change wording of subject
and commit message accordingly.
v2: Use be16_to_cpu().
Add comment to patch description suggesting that the driver may have other endianness related problems.
drivers/staging/r8188eu/core/rtw_br_ext.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/staging/r8188eu/core/rtw_br_ext.c +1 -1
@@ -70,7 +70,7 @@ static int __nat25_add_pppoe_tag(struct sk_buff *skb, struct pppoe_tag *tag)struct pppoe_hdr *ph = (struct pppoe_hdr *)(skb->data +ETH_HLEN );int data_len; - data_len = tag->tag_len +TAG_HDR_LEN ; + data_len =be16_to_cpu (tag->tag_len) +TAG_HDR_LEN ;if (skb_tailroom (skb) < data_len)return -1 ;
Signature · 1 line
2.35.1