[PATCH net-next] net: qualcomm: rmnet: fix two pointer math bugs

We recently changed these two pointers from void pointers to struct
pointers and it breaks the pointer math so now the "txphdr" points
beyond the end of the buffer.

Fixes: 56a967c4f7e5 ("net: qualcomm: rmnet: Remove some unneeded casts")
Signed-off-by: Dan Carpenter <redacted>
---
 drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c b/drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c
index 3ee5c1a8b46e..3676976c875b 100644
--- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c
+++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c

@@ -168,7 +168,7 @@ static void rmnet_map_complement_ipv4_txporthdr_csum_field(struct iphdr *ip4h)
 	void *txphdr;
 	u16 *csum;
 
-	txphdr = ip4h + ip4h->ihl * 4;
+	txphdr = (void *)ip4h + ip4h->ihl * 4;
 
 	if (ip4h->protocol == IPPROTO_TCP || ip4h->protocol == IPPROTO_UDP) {
 		csum = (u16 *)rmnet_map_get_csum_field(ip4h->protocol, txphdr);

@@ -203,7 +203,7 @@ rmnet_map_complement_ipv6_txporthdr_csum_field(struct ipv6hdr *ip6h)
 	void *txphdr;
 	u16 *csum;
 
-	txphdr = ip6h + sizeof(struct ipv6hdr);
+	txphdr = ip6h + 1;
 
 	if (ip6h->nexthdr == IPPROTO_TCP || ip6h->nexthdr == IPPROTO_UDP) {
 		csum = (u16 *)rmnet_map_get_csum_field(ip6h->nexthdr, txphdr);

-- 
2.30.2

On 2021-06-19 07:52, Dan Carpenter wrote:

Hi Dan

Thanks for fixing this. Could you cast the ip4h to char* instead of 
void*.
Looks like gcc might raise issues if -Wpointer-arith is used.

https://gcc.gnu.org/onlinedocs/gcc-4.5.0/gcc/Pointer-Arith.html#Pointer-Arith

On Sat, Jun 19, 2021 at 01:12:09PM -0600, subashab@codeaurora.org wrote:

On 2021-06-19 07:52, Dan Carpenter wrote:

Hi Dan

Thanks for fixing this. Could you cast the ip4h to char* instead of void*.
Looks like gcc might raise issues if -Wpointer-arith is used.

https://gcc.gnu.org/onlinedocs/gcc-4.5.0/gcc/Pointer-Arith.html#Pointer-Arith

The fix for that is to not enable -Wpointer-arith.  The warning is dumb.

regards,
dan carpenter

On Mon, Jun 21, 2021 at 10:11:58AM +0300, Dan Carpenter wrote:

On Sat, Jun 19, 2021 at 01:12:09PM -0600, subashab@codeaurora.org wrote:

quoted

On 2021-06-19 07:52, Dan Carpenter wrote:

Hi Dan

Thanks for fixing this. Could you cast the ip4h to char* instead of void*.
Looks like gcc might raise issues if -Wpointer-arith is used.

https://gcc.gnu.org/onlinedocs/gcc-4.5.0/gcc/Pointer-Arith.html#Pointer-Arith

The fix for that is to not enable -Wpointer-arith.  The warning is dumb.

Sorry, that was uncalled for and not correct.  The GCC warning would be
useful if we were trying to write portable userspace code.  But in the
kernel the kernel uses GCC extensions a lot.

The Clang compiler can also compile the kernel these days.  But it had
to add support for a bunch of GCC extensions to make that work.  Really
most of linux userspace is written with GCC in mind so Clang had to do
this anyway.

So we will never enable -Wpointer-arith in the kernel because there is
no need.

regards,
dan carpenter

On 2021-06-21 01:18, Dan Carpenter wrote:

On Mon, Jun 21, 2021 at 10:11:58AM +0300, Dan Carpenter wrote:

quoted

On Sat, Jun 19, 2021 at 01:12:09PM -0600, subashab@codeaurora.org 
wrote:

quoted

On 2021-06-19 07:52, Dan Carpenter wrote:

Hi Dan

Thanks for fixing this. Could you cast the ip4h to char* instead of void*.
Looks like gcc might raise issues if -Wpointer-arith is used.

https://gcc.gnu.org/onlinedocs/gcc-4.5.0/gcc/Pointer-Arith.html#Pointer-Arith

The fix for that is to not enable -Wpointer-arith.  The warning is 
dumb.

Sorry, that was uncalled for and not correct.  The GCC warning would be
useful if we were trying to write portable userspace code.  But in the
kernel the kernel uses GCC extensions a lot.

The Clang compiler can also compile the kernel these days.  But it had
to add support for a bunch of GCC extensions to make that work.  Really
most of linux userspace is written with GCC in mind so Clang had to do
this anyway.

So we will never enable -Wpointer-arith in the kernel because there is
no need.

regards,
dan carpenter

Thanks for the clarification.

Reviewed-by: Subash Abhinov Kasiviswanathan <redacted>

Hello:

This patch was applied to netdev/net-next.git (refs/heads/master):

On Sat, 19 Jun 2021 16:52:22 +0300 you wrote:

We recently changed these two pointers from void pointers to struct
pointers and it breaks the pointer math so now the "txphdr" points
beyond the end of the buffer.

Fixes: 56a967c4f7e5 ("net: qualcomm: rmnet: Remove some unneeded casts")
Signed-off-by: Dan Carpenter <redacted>

[...]

Here is the summary with links:
  - [net-next] net: qualcomm: rmnet: fix two pointer math bugs
    https://git.kernel.org/netdev/net-next/c/753ba09aa3ea

You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html