From patchwork Mon Sep 19 11:09:57 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Arend Van Spriel X-Patchwork-Id: 9339045 X-Patchwork-Delegate: kvalo@adurom.com Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 98FE7601C2 for ; Mon, 19 Sep 2016 11:10:42 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 86B2B291C4 for ; Mon, 19 Sep 2016 11:10:42 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 76ED729189; Mon, 19 Sep 2016 11:10:42 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=2.0 tests=BAYES_00,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id F35B92913A for ; Mon, 19 Sep 2016 11:10:41 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1759050AbcISLKj (ORCPT ); Mon, 19 Sep 2016 07:10:39 -0400 Received: from mail-gw2-out.broadcom.com ([216.31.210.63]:34274 "EHLO mail-gw2-out.broadcom.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1756627AbcISLKZ (ORCPT ); Mon, 19 Sep 2016 07:10:25 -0400 X-IronPort-AV: E=Sophos;i="5.30,361,1470726000"; d="scan'208";a="105381083" Received: from mail-irv-18.broadcom.com ([10.15.198.37]) by mail-gw2-out.broadcom.com with ESMTP; 19 Sep 2016 04:44:38 -0700 Received: from mail-irva-12.broadcom.com (mail-irva-12.broadcom.com [10.11.16.101]) by mail-irv-18.broadcom.com (Postfix) with ESMTP id 99D228202C; Mon, 19 Sep 2016 04:10:24 -0700 (PDT) Received: from jenkins-cam-14.cam.broadcom.com (jenkins-cam-14.cam.broadcom.com [10.177.128.77]) by mail-irva-12.broadcom.com (Postfix) with ESMTP id CABD2A62D1; Mon, 19 Sep 2016 04:10:04 -0700 (PDT) Received: by jenkins-cam-14.cam.broadcom.com (Postfix, from userid 25152) id F2836B85052; Mon, 19 Sep 2016 12:10:01 +0100 (BST) From: Arend van Spriel To: Kalle Valo Cc: linux-wireless , Hante Meuleman , Arend van Spriel Subject: [PATCH 7/9] brcmfmac: fix clearing entry IPv6 address Date: Mon, 19 Sep 2016 12:09:57 +0100 Message-Id: <1474283399-14385-8-git-send-email-arend.vanspriel@broadcom.com> X-Mailer: git-send-email 1.9.1 In-Reply-To: <1474283399-14385-1-git-send-email-arend.vanspriel@broadcom.com> References: <1474283399-14385-1-git-send-email-arend.vanspriel@broadcom.com> Sender: linux-wireless-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-wireless@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP From: Hante Meuleman When IPv6 address is to be cleared there is a possible out of bound access. But also the clearing of the last entry and the adjustment of total number of stored IPv6 addresses is not updated. This patch fixes that bug. Bug was found using coverity. Reviewed-by: Arend Van Spriel Reviewed-by: Franky Lin Reviewed-by: Pieter-Paul Giesberts Signed-off-by: Hante Meuleman Signed-off-by: Arend van Spriel --- drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c index 3394184..bb71199 100644 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c @@ -873,9 +873,12 @@ static int brcmf_inet6addr_changed(struct notifier_block *nb, } break; case NETDEV_DOWN: - if (i < NDOL_MAX_ENTRIES) - for (; i < ifp->ipv6addr_idx; i++) + if (i < NDOL_MAX_ENTRIES) { + for (; i < ifp->ipv6addr_idx - 1; i++) table[i] = table[i + 1]; + memset(&table[i], 0, sizeof(table[i])); + ifp->ipv6addr_idx--; + } break; default: break;