| Message ID | 1392350408-3811-1-git-send-email-wuzhy@linux.vnet.ibm.com |
|---|---|
| State | Rejected, archived |
| Delegated to: | David Miller |
| Headers | show |
From: Zhi Yong Wu <wuzhy@linux.vnet.ibm.com> Date: Fri, 14 Feb 2014 12:00:08 +0800 > The pointer hdr isn't assigned before hdr->mhdr and hdr->hdr > are used, so it could be one invalid pointer. > > Signed-off-by: Zhi Yong Wu <wuzhy@linux.vnet.ibm.com> sizeof(x) does not evaluate any dereferences made by 'x' -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
On Fri, Feb 14, 2014 at 1:12 PM, David Miller <davem@davemloft.net> wrote: > From: Zhi Yong Wu <wuzhy@linux.vnet.ibm.com> > Date: Fri, 14 Feb 2014 12:00:08 +0800 > >> The pointer hdr isn't assigned before hdr->mhdr and hdr->hdr >> are used, so it could be one invalid pointer. >> >> Signed-off-by: Zhi Yong Wu <wuzhy@linux.vnet.ibm.com> > > sizeof(x) does not evaluate any dereferences made by 'x' thanks for your explanation. > -- > To unsubscribe from this list: send the line "unsubscribe netdev" in > the body of a message to majordomo@vger.kernel.org > More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c index d75f8ed..bf6397f 100644 --- a/drivers/net/virtio_net.c +++ b/drivers/net/virtio_net.c @@ -807,9 +807,9 @@ static int xmit_skb(struct send_queue *sq, struct sk_buff *skb) pr_debug("%s: xmit %p %pM\n", vi->dev->name, skb, dest); if (vi->mergeable_rx_bufs) - hdr_len = sizeof hdr->mhdr; + hdr_len = sizeof(struct virtio_net_hdr_mrg_rxbuf); else - hdr_len = sizeof hdr->hdr; + hdr_len = sizeof(struct virtio_net_hdr); can_push = vi->any_header_sg && !((unsigned long)skb->data & (__alignof__(*hdr) - 1)) &&
The pointer hdr isn't assigned before hdr->mhdr and hdr->hdr are used, so it could be one invalid pointer. Signed-off-by: Zhi Yong Wu <wuzhy@linux.vnet.ibm.com> --- drivers/net/virtio_net.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)