From patchwork Thu May 24 00:02:14 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Adham Abozaeid X-Patchwork-Id: 10422505 X-Patchwork-Delegate: kvalo@adurom.com Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 0F08960327 for ; Thu, 24 May 2018 00:07:45 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 009BA29221 for ; Thu, 24 May 2018 00:07:45 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id E85EC292BC; Thu, 24 May 2018 00:07:44 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.9 required=2.0 tests=BAYES_00, MAILING_LIST_MULTI, RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 4C14C29221 for ; Thu, 24 May 2018 00:07:43 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S935106AbeEXAHm (ORCPT ); Wed, 23 May 2018 20:07:42 -0400 Received: from esa1.microchip.iphmx.com ([68.232.147.91]:20988 "EHLO esa1.microchip.iphmx.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S934412AbeEXAHl (ORCPT ); Wed, 23 May 2018 20:07:41 -0400 X-IronPort-AV: E=Sophos;i="5.49,435,1520924400"; d="scan'208";a="15257596" Received: from smtpout.microchip.com (HELO email.microchip.com) ([198.175.253.82]) by esa1.microchip.iphmx.com with ESMTP/TLS/DHE-RSA-AES256-SHA; 23 May 2018 17:07:40 -0700 Received: from adham-Latitude-E7450.microchip.com (10.10.76.4) by chn-sv-exch07.mchp-main.com (10.10.76.108) with Microsoft SMTP Server id 14.3.352.0; Wed, 23 May 2018 17:07:40 -0700 From: Adham Abozaeid To: CC: , , Ganesh Krishna , Robert Jensen Tebbs , Aditya Shankar , Claudiu Beznea , Ajay Kathat , Adham Abozaeid Subject: [PATCH] staging: wilc1000: Avoid overriding rates_no while parsing ies element. Date: Wed, 23 May 2018 17:02:14 -0700 Message-ID: <1527120134-11058-1-git-send-email-adham.abozaeid@microchip.com> X-Mailer: git-send-email 2.7.4 MIME-Version: 1.0 Sender: linux-wireless-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-wireless@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP Commit d4b4aaba515a ("staging: wilc1000: fix line over 80 characters in host_int_parse_join_bss_param()") introduced a bug by not keeping the rates_no value while parsing ies elements. It also increments auth_total_cnt as a pointer instead of its reference. This commit fixes the bug by passing reference to rates_no to host_int_parse_join_bss_param() and by incrementing reference of auth_total_cnt Fixes: d4b4aaba515a (staging: wilc1000: fix line over 80 characters in host_int_parse_join_bss_param()) Signed-off-by: Adham Abozaeid --- drivers/staging/wilc1000/host_interface.c | 24 +++++++++++++----------- 1 file changed, 13 insertions(+), 11 deletions(-) diff --git a/drivers/staging/wilc1000/host_interface.c b/drivers/staging/wilc1000/host_interface.c index a2f82c8..bf7dd18d 100644 --- a/drivers/staging/wilc1000/host_interface.c +++ b/drivers/staging/wilc1000/host_interface.c @@ -3813,9 +3813,9 @@ int wilc_setup_multicast_filter(struct wilc_vif *vif, bool enabled, static void host_int_fill_join_bss_param(struct join_bss_param *param, u8 *ies, u16 *out_index, u8 *pcipher_tc, - u8 *auth_total_cnt, u32 tsf_lo) + u8 *auth_total_cnt, u32 tsf_lo, + u8 *rates_no) { - u8 rates_no = 0; u8 ext_rates_no; u16 offset; u8 pcipher_cnt; @@ -3824,23 +3824,23 @@ static void host_int_fill_join_bss_param(struct join_bss_param *param, u8 *ies, u16 index = *out_index; if (ies[index] == SUPP_RATES_IE) { - rates_no = ies[index + 1]; - param->supp_rates[0] = rates_no; + *rates_no = ies[index + 1]; + param->supp_rates[0] = *rates_no; index += 2; - for (i = 0; i < rates_no; i++) + for (i = 0; i < *rates_no; i++) param->supp_rates[i + 1] = ies[index + i]; - index += rates_no; + index += *rates_no; } else if (ies[index] == EXT_SUPP_RATES_IE) { ext_rates_no = ies[index + 1]; - if (ext_rates_no > (MAX_RATES_SUPPORTED - rates_no)) + if (ext_rates_no > (MAX_RATES_SUPPORTED - *rates_no)) param->supp_rates[0] = MAX_RATES_SUPPORTED; else param->supp_rates[0] += ext_rates_no; index += 2; - for (i = 0; i < (param->supp_rates[0] - rates_no); i++) - param->supp_rates[rates_no + i + 1] = ies[index + i]; + for (i = 0; i < (param->supp_rates[0] - *rates_no); i++) + param->supp_rates[*rates_no + i + 1] = ies[index + i]; index += ext_rates_no; } else if (ies[index] == HT_CAPABILITY_IE) { @@ -3929,7 +3929,7 @@ static void host_int_fill_join_bss_param(struct join_bss_param *param, u8 *ies, *policy = ies[rsn_idx + ((j + 1) * 4) - 1]; } - auth_total_cnt += auth_cnt; + *auth_total_cnt += auth_cnt; rsn_idx += offset; if (ies[index] == RSN_IE) { @@ -3950,6 +3950,7 @@ static void *host_int_parse_join_bss_param(struct network_info *info) { struct join_bss_param *param = NULL; u16 index = 0; + u8 rates_no = 0; u8 pcipher_total_cnt = 0; u8 auth_total_cnt = 0; @@ -3969,7 +3970,8 @@ static void *host_int_parse_join_bss_param(struct network_info *info) while (index < info->ies_len) host_int_fill_join_bss_param(param, info->ies, &index, &pcipher_total_cnt, - &auth_total_cnt, info->tsf_lo); + &auth_total_cnt, info->tsf_lo, + &rates_no); return (void *)param; }