Thread (12 messages) 12 messages, 3 authors, 2016-09-26
STALE3592d REVIEWED: 3 (0M)

[PATCH 2/9] brcmfmac: rework pointer trickery in brcmf_proto_bcdc_query_dcmd()

From: Arend van Spriel <arend.vanspriel@broadcom.com>
Date: 2016-09-19 11:10:24
Subsystem: broadcom brcm80211 ieee802.11 wireless drivers, the rest · Maintainers: Arend van Spriel, Linus Torvalds

The variable info is assigned to point to bcdc->msg[1], which is the
same as pointing to bcdc->buf. As that is what we want to access
make it clear by fixing the assignment. This also avoid out-of-bounds
errors from static analyzers are bcdc->msg[1] is not in the structure
definition.

Reviewed-by: Hante Meuleman <redacted>
Reviewed-by: Pieter-Paul Giesberts <redacted>
Reviewed-by: Franky Lin <redacted>
Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
---
 drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.c
index d1bc51f..038a960 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.c
@@ -194,7 +194,7 @@ retry:
 	}
 
 	/* Check info buffer */
-	info = (void *)&msg[1];
+	info = (void *)&bcdc->buf[0];
 
 	/* Copy info buffer */
 	if (buf) {
-- 
1.9.1
Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help