diff options
| author | Eyal Shapira <eyal@wizery.com> | 2014-01-05 20:04:19 +0100 |
|---|---|---|
| committer | Emmanuel Grumbach <emmanuel.grumbach@intel.com> | 2014-01-13 21:17:16 +0100 |
| commit | 560843f4ab7ba8c2e5edf01949bba4d7a94f01e9 (patch) | |
| tree | 5a880b673bf3dd85b3e5a5123eda8b3bc103292c /drivers/net | |
| parent | iwlwifi: mvm: send all the NVM sections to the NIC (diff) | |
| download | linux-560843f4ab7ba8c2e5edf01949bba4d7a94f01e9.tar.xz linux-560843f4ab7ba8c2e5edf01949bba4d7a94f01e9.zip | |
iwlwifi: mvm: rs: fix a theoretical out of bounds access
Discovered by klocwork
Array 'iwl_rate_mcs' of size 15 may use index value(s) -1
* rs.c:2562: index = iwl_hwrate_to_plcp_idx(rate)
* rs.c:2562: Result of function call 'iwl_hwrate_to_plcp_idx(rate)' is '[-1,14]'
* rs.c:2565: Array 'iwl_rate_mcs' size is 15.
* rs.c:2565: Possible attempt to access element -1 of array 'iwl_rate_mcs'.
While at it stop using index = -1 and always use IWL_RATE_INVALID
Signed-off-by: Eyal Shapira <eyalx.shapira@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Diffstat (limited to 'drivers/net')
| -rw-r--r-- | drivers/net/wireless/iwlwifi/mvm/rs.c | 10 |
1 files changed, 5 insertions, 5 deletions
diff --git a/drivers/net/wireless/iwlwifi/mvm/rs.c b/drivers/net/wireless/iwlwifi/mvm/rs.c index 54887b952eb5..c4f214d4c44e 100644 --- a/drivers/net/wireless/iwlwifi/mvm/rs.c +++ b/drivers/net/wireless/iwlwifi/mvm/rs.c @@ -357,7 +357,7 @@ static int iwl_hwrate_to_plcp_idx(u32 rate_n_flags) return idx; } - return -1; + return IWL_RATE_INVALID; } static void rs_rate_scale_perform(struct iwl_mvm *mvm, @@ -703,10 +703,8 @@ static int rs_rate_from_ucode_rate(const u32 ucode_rate, memset(rate, 0, sizeof(*rate)); rate->index = iwl_hwrate_to_plcp_idx(ucode_rate); - if (rate->index == IWL_RATE_INVALID) { - rate->index = -1; + if (rate->index == IWL_RATE_INVALID) return -EINVAL; - } rate->ant = (ant_msk >> RATE_MCS_ANT_POS); @@ -2562,7 +2560,9 @@ static int rs_pretty_print_rate(char *buf, const u32 rate) int index = iwl_hwrate_to_plcp_idx(rate); return sprintf(buf, "Legacy | ANT: %s Rate: %s Mbps\n", - rs_pretty_ant(ant), iwl_rate_mcs[index].mbps); + rs_pretty_ant(ant), + index == IWL_RATE_INVALID ? "BAD" : + iwl_rate_mcs[index].mbps); } if (rate & RATE_MCS_VHT_MSK) { |