package/kernel/mac80211/patches/351-0040-brcmfmac-rework-pointer-trickery-in-brcmf_proto_bcdc.patch

   1 From 704d1c6b56f4ee2ad6a5f012a72a278d17c1a223 Mon Sep 17 00:00:00 2001
   2 From: Arend Van Spriel <arend.vanspriel@broadcom.com>
   3 Date: Mon, 19 Sep 2016 12:09:52 +0100
   4 Subject: [PATCH] brcmfmac: rework pointer trickery in
   5  brcmf_proto_bcdc_query_dcmd()
   6
   7 The variable info is assigned to point to bcdc->msg[1], which is the
   8 same as pointing to bcdc->buf. As that is what we want to access
   9 make it clear by fixing the assignment. This also avoid out-of-bounds
  10 errors from static analyzers are bcdc->msg[1] is not in the structure
  11 definition.
  12
  13 Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
  14 Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
  15 Reviewed-by: Franky Lin <franky.lin@broadcom.com>
  16 Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
  17 Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  18 ---
  19  drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.c | 2 +-
  20  1 file changed, 1 insertion(+), 1 deletion(-)
  21
  22 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.c
  23 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.c
  24 @@ -194,7 +194,7 @@ retry:
  25         }
  26
  27         /* Check info buffer */
  28 -       info = (void *)&msg[1];
  29 +       info = (void *)&bcdc->buf[0];
  30
  31         /* Copy info buffer */
  32         if (buf) {