diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2021-06-19 16:52:22 +0300 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2021-06-21 12:19:19 -0700 |
| commit | 753ba09aa3ea14b593b168d3ef541da00f4659f5 (patch) | |
| tree | 6ef770d1e3d2c7d7e0731904c42e08a555421d99 /drivers/net/ethernet/qualcomm | |
| parent | d5fff4629beadf262559cae79012ce0dee268c1d (diff) | |
| download | linux-753ba09aa3ea14b593b168d3ef541da00f4659f5.tar.gz linux-753ba09aa3ea14b593b168d3ef541da00f4659f5.tar.bz2 linux-753ba09aa3ea14b593b168d3ef541da00f4659f5.zip | |
net: qualcomm: rmnet: fix two pointer math bugs
We recently changed these two pointers from void pointers to struct
pointers and it breaks the pointer math so now the "txphdr" points
beyond the end of the buffer.
Fixes: 56a967c4f7e5 ("net: qualcomm: rmnet: Remove some unneeded casts")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers/net/ethernet/qualcomm')
| -rw-r--r-- | drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c b/drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c index 3ee5c1a8b46e..3676976c875b 100644 --- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c +++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c @@ -168,7 +168,7 @@ static void rmnet_map_complement_ipv4_txporthdr_csum_field(struct iphdr *ip4h) void *txphdr; u16 *csum; - txphdr = ip4h + ip4h->ihl * 4; + txphdr = (void *)ip4h + ip4h->ihl * 4; if (ip4h->protocol == IPPROTO_TCP || ip4h->protocol == IPPROTO_UDP) { csum = (u16 *)rmnet_map_get_csum_field(ip4h->protocol, txphdr); @@ -203,7 +203,7 @@ rmnet_map_complement_ipv6_txporthdr_csum_field(struct ipv6hdr *ip6h) void *txphdr; u16 *csum; - txphdr = ip6h + sizeof(struct ipv6hdr); + txphdr = ip6h + 1; if (ip6h->nexthdr == IPPROTO_TCP || ip6h->nexthdr == IPPROTO_UDP) { csum = (u16 *)rmnet_map_get_csum_field(ip6h->nexthdr, txphdr); |