Staging: rtl8192u: fix some memory corruption (f7738eda) · Commits · 戴 / test

When we received a command we incremented a stat counter depending on the type of message. The problem is there were 8 types of commands but there were only 4 counters allocated so it corrupted memory past the end of the rxcmdpkt[] array. The fix is just to remove the counters because they aren't used. Signed-off-by:

Dan Carpenter <dan.carpenter@oracle.com> ACKed-by:

Larry Finger <Larry.Finger@lwfinger.net> Signed-off-by:

Greg Kroah-Hartman <gregkh@linuxfoundation.org>

drivers/staging/rtl8192u/r8192U.h

+0 −1

Original line number	Diff line number	Diff line
		@@ -610,7 +610,6 @@ typedef struct Stats
		// unsigned long rxnopointer;
		unsigned long rxok;
		unsigned long rxframgment;
		unsigned long rxcmdpkt[4]; //08/05/08 amy rx cmd element txfeedback/bcn report/cfg set/query
		unsigned long rxurberr;
		unsigned long rxstaterr;
		unsigned long received_rate_histogram[4][32]; //0: Total, 1:OK, 2:CRC, 3:ICV, 2007 07 03 cosa

drivers/staging/rtl8192u/r819xU_cmdpkt.c

+0 −4

Original line number	Diff line number	Diff line
		@@ -697,7 +697,6 @@ cmpk_message_handle_rx(
		struct ieee80211_rx_stats *pstats)
		{
		// u32 debug_level = DBG_LOUD;
		struct r8192_priv *priv = ieee80211_priv(dev);
		int total_length;
		u8 cmd_length, exe_cnt = 0;
		u8 element_id;
		@@ -779,9 +778,6 @@ cmpk_message_handle_rx(
		// 2007/01/22 MH Add to display tx statistic.
		//cmpk_DisplayTxStatistic(pAdapter);

		/* 2007/03/09 MH Collect sidderent cmd element pkt num. */
		priv->stats.rxcmdpkt[element_id]++;

		total_length -= cmd_length;
		pcmd_buff += cmd_length;
		} /* while (total_length > 0) */

Admin message