From patchwork Mon Jul 16 18:44:24 2012 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: manjunatha_halli@ti.com X-Patchwork-Id: 1201591 Return-Path: X-Original-To: patchwork-linux-media@patchwork.kernel.org Delivered-To: patchwork-process-083081@patchwork2.kernel.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by patchwork2.kernel.org (Postfix) with ESMTP id 3A3AFE0038 for ; Mon, 16 Jul 2012 18:44:57 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753798Ab2GPSoc (ORCPT ); Mon, 16 Jul 2012 14:44:32 -0400 Received: from devils.ext.ti.com ([198.47.26.153]:48499 "EHLO devils.ext.ti.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751916Ab2GPSo3 (ORCPT ); Mon, 16 Jul 2012 14:44:29 -0400 Received: from dlelxv30.itg.ti.com ([172.17.2.17]) by devils.ext.ti.com (8.13.7/8.13.7) with ESMTP id q6GIiRrf004689; Mon, 16 Jul 2012 13:44:27 -0500 Received: from DLEE74.ent.ti.com (dlee74.ent.ti.com [157.170.170.8]) by dlelxv30.itg.ti.com (8.13.8/8.13.8) with ESMTP id q6GIiRRh014437; Mon, 16 Jul 2012 13:44:27 -0500 Received: from dlelxv24.itg.ti.com (172.17.1.199) by DLEE74.ent.ti.com (157.170.170.8) with Microsoft SMTP Server id 14.1.323.3; Mon, 16 Jul 2012 13:44:27 -0500 Received: from legion.dal.design.ti.com (legion.dal.design.ti.com [128.247.22.53]) by dlelxv24.itg.ti.com (8.13.8/8.13.8) with ESMTP id q6GIiR63026728; Mon, 16 Jul 2012 13:44:27 -0500 Received: from dirac.dal.design.ti.com (dirac.dal.design.ti.com [10.248.4.197]) by legion.dal.design.ti.com (8.11.7p1+Sun/8.11.7) with ESMTP id q6GIiQW02419; Mon, 16 Jul 2012 13:44:26 -0500 (CDT) Received: from dirac.dal.design.ti.com (localhost.localdomain [127.0.0.1]) by dirac.dal.design.ti.com (8.13.1/8.13.1) with ESMTP id q6GIiQl1015120; Mon, 16 Jul 2012 13:44:26 -0500 Received: (from x0130808@localhost) by dirac.dal.design.ti.com (8.13.1/8.13.1/Submit) id q6GIiQ6V015117; Mon, 16 Jul 2012 13:44:26 -0500 From: To: CC: , , Manjunatha Halli Subject: [PATCH] wl12xx: Fix for overflow while getting irq status Date: Mon, 16 Jul 2012 13:44:24 -0500 Message-ID: <1342464264-15069-1-git-send-email-manjunatha_halli@ti.com> X-Mailer: git-send-email 1.7.4.1 MIME-Version: 1.0 Sender: linux-media-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-media@vger.kernel.org From: Manjunatha Halli ->dlen is 8 bit long and so while memcpy there is a chance that fmdev->irq_info.flag will overflow. So this patch removes memcpy and instead copies the 16bit flag register value from skb->data to fmdev->irq_info.flag directly. Change-Id: I37604b91b2777ed9e56a7e1c1ecefe32e9024170 Signed-off-by: Manjunatha Halli --- drivers/media/radio/wl128x/fmdrv_common.c | 8 +++----- 1 files changed, 3 insertions(+), 5 deletions(-) diff --git a/drivers/media/radio/wl128x/fmdrv_common.c b/drivers/media/radio/wl128x/fmdrv_common.c index bf867a6..54c549b 100644 --- a/drivers/media/radio/wl128x/fmdrv_common.c +++ b/drivers/media/radio/wl128x/fmdrv_common.c @@ -584,18 +584,16 @@ static void fm_irq_send_flag_getcmd(struct fmdev *fmdev) static void fm_irq_handle_flag_getcmd_resp(struct fmdev *fmdev) { struct sk_buff *skb; - struct fm_event_msg_hdr *fm_evt_hdr; if (check_cmdresp_status(fmdev, &skb)) return; - fm_evt_hdr = (void *)skb->data; - /* Skip header info and copy only response data */ skb_pull(skb, sizeof(struct fm_event_msg_hdr)); - memcpy(&fmdev->irq_info.flag, skb->data, fm_evt_hdr->dlen); - fmdev->irq_info.flag = be16_to_cpu(fmdev->irq_info.flag); + /* Copy 16 bit flag register value from skb->data */ + fmdev->irq_info.flag = (u16) ((skb->data[0] << 8) | skb->data[1]); + fmdbg("irq: flag register(0x%x)\n", fmdev->irq_info.flag); /* Continue next function in interrupt handler table */