| Message ID | 20190619053208.17243-1-john@phrozen.org (mailing list archive) |
|---|---|
| State | Superseded |
| Delegated to: | Kalle Valo |
| Headers | show |
| Series | ath11k: fix mac_cap_info copy size | expand |
On 19/06/2019 07:32, John Crispin wrote: > The code currently copies the he_cap field when adding a peer from a six > byte to an eight byte buffer. Switch from using the dest buffer length to > that of the src buffer. Also make sure that the trailing 2 bytes are > zero'ed out. > > Signed-off-by: John Crispin <john@phrozen.org> > --- > drivers/net/wireless/ath/ath11k/mac.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > diff --git a/drivers/net/wireless/ath/ath11k/mac.c b/drivers/net/wireless/ath/ath11k/mac.c > index 53177a9e3c7e..7239013b59ca 100644 > --- a/drivers/net/wireless/ath/ath11k/mac.c > +++ b/drivers/net/wireless/ath/ath11k/mac.c > @@ -1262,8 +1262,9 @@ static void ath11k_peer_assoc_h_he(struct ath11k *ar, > > arg->he_flag = true; > > + memset(&arg->peer_he_cap_macinfo, 0, sizeof(&arg->peer_he_cap_macinfo)); stray & ... forgot to commit --amend prior to sending this John > memcpy(&arg->peer_he_cap_macinfo, he_cap->he_cap_elem.mac_cap_info, > - sizeof(arg->peer_he_cap_macinfo)); > + sizeof(he_cap->he_cap_elem.mac_cap_info)); > memcpy(&arg->peer_he_cap_phyinfo, he_cap->he_cap_elem.phy_cap_info, > sizeof(arg->peer_he_cap_phyinfo)); > memcpy(&arg->peer_he_ops, &vif->bss_conf.he_operation,
diff --git a/drivers/net/wireless/ath/ath11k/mac.c b/drivers/net/wireless/ath/ath11k/mac.c index 53177a9e3c7e..7239013b59ca 100644 --- a/drivers/net/wireless/ath/ath11k/mac.c +++ b/drivers/net/wireless/ath/ath11k/mac.c @@ -1262,8 +1262,9 @@ static void ath11k_peer_assoc_h_he(struct ath11k *ar, arg->he_flag = true; + memset(&arg->peer_he_cap_macinfo, 0, sizeof(&arg->peer_he_cap_macinfo)); memcpy(&arg->peer_he_cap_macinfo, he_cap->he_cap_elem.mac_cap_info, - sizeof(arg->peer_he_cap_macinfo)); + sizeof(he_cap->he_cap_elem.mac_cap_info)); memcpy(&arg->peer_he_cap_phyinfo, he_cap->he_cap_elem.phy_cap_info, sizeof(arg->peer_he_cap_phyinfo)); memcpy(&arg->peer_he_ops, &vif->bss_conf.he_operation,
The code currently copies the he_cap field when adding a peer from a six byte to an eight byte buffer. Switch from using the dest buffer length to that of the src buffer. Also make sure that the trailing 2 bytes are zero'ed out. Signed-off-by: John Crispin <john@phrozen.org> --- drivers/net/wireless/ath/ath11k/mac.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)