From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Bing Zhao <bzhao@marvell.com>,
"John W. Linville" <linville@tuxdriver.com>
Subject: [ 27/49] mwifiex: fix potential out-of-boundary access to ibss rate table
Date: Tue, 26 Mar 2013 16:01:24 -0700 [thread overview]
Message-ID: <20130326225842.345990024@linuxfoundation.org> (raw)
In-Reply-To: <20130326225839.554028294@linuxfoundation.org>
3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bing Zhao <bzhao@marvell.com>
commit 5f0fabf84d7b52f979dcbafa3d3c530c60d9a92c upstream.
smatch found this error:
CHECK drivers/net/wireless/mwifiex/join.c
drivers/net/wireless/mwifiex/join.c:1121
mwifiex_cmd_802_11_ad_hoc_join()
error: testing array offset 'i' after use.
Signed-off-by: Bing Zhao <bzhao@marvell.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/mwifiex/join.c | 7 +++----
1 file changed, 3 insertions(+), 4 deletions(-)
--- a/drivers/net/wireless/mwifiex/join.c
+++ b/drivers/net/wireless/mwifiex/join.c
@@ -1102,10 +1102,9 @@ mwifiex_cmd_802_11_ad_hoc_join(struct mw
adhoc_join->bss_descriptor.bssid,
adhoc_join->bss_descriptor.ssid);
- for (i = 0; bss_desc->supported_rates[i] &&
- i < MWIFIEX_SUPPORTED_RATES;
- i++)
- ;
+ for (i = 0; i < MWIFIEX_SUPPORTED_RATES &&
+ bss_desc->supported_rates[i]; i++)
+ ;
rates_size = i;
/* Copy Data Rates from the Rates recorded in scan response */
next prev parent reply other threads:[~2013-03-26 23:02 UTC|newest]
Thread overview: 53+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-03-26 23:00 [ 00/49] 3.0.71-stable review Greg Kroah-Hartman
2013-03-26 23:00 ` [ 01/49] Revert "USB: EHCI: dont check DMA values in QH overlays" Greg Kroah-Hartman
2013-03-26 23:00 ` [ 02/49] sunsu: Fix panic in case of nonexistent port at "console=ttySY" cmdline option Greg Kroah-Hartman
2013-03-26 23:01 ` [ 03/49] net/ipv4: Ensure that location of timestamp option is stored Greg Kroah-Hartman
2013-03-26 23:01 ` [ 04/49] netconsole: dont call __netpoll_cleanup() while atomic Greg Kroah-Hartman
2013-03-26 23:01 ` [ 05/49] sctp: dont break the loop while meeting the active_path so as to find the matched transport Greg Kroah-Hartman
2013-03-26 23:01 ` [ 06/49] ipv4: fix definition of FIB_TABLE_HASHSZ Greg Kroah-Hartman
2013-03-26 23:01 ` [ 07/49] rtnetlink: Mask the rta_type when range checking Greg Kroah-Hartman
2013-03-26 23:01 ` [ 08/49] inet: limit length of fragment queue hash table bucket lists Greg Kroah-Hartman
2013-03-26 23:01 ` [ 09/49] sfc: Fix loop condition for efx_filter_search() when !for_insert Greg Kroah-Hartman
2013-03-26 23:01 ` [ 10/49] sfc: Fix Siena mac statistics on big endian platforms Greg Kroah-Hartman
2013-03-26 23:01 ` [ 11/49] sfc: Do not attempt to flush queues if DMA is disabled Greg Kroah-Hartman
2013-03-26 23:01 ` [ 12/49] sfc: Convert firmware subtypes to native byte order in efx_mcdi_get_board_cfg() Greg Kroah-Hartman
2013-03-26 23:01 ` [ 13/49] sfc: Fix two causes of flush failure Greg Kroah-Hartman
2013-03-26 23:01 ` [ 14/49] sfc: lock TX queues when calling netif_device_detach() Greg Kroah-Hartman
2013-03-26 23:01 ` [ 15/49] sfc: Fix timekeeping in efx_mcdi_poll() Greg Kroah-Hartman
2013-03-26 23:01 ` [ 16/49] sfc: Properly sync RX DMA buffer when it is not the last in the page Greg Kroah-Hartman
2013-03-26 23:01 ` [ 17/49] sfc: Fix efx_rx_buf_offset() in the presence of swiotlb Greg Kroah-Hartman
2013-03-26 23:01 ` [ 18/49] sfc: Detach net device when stopping queues for reconfiguration Greg Kroah-Hartman
2013-03-26 23:01 ` [ 19/49] sfc: Disable soft interrupt handling during efx_device_detach_sync() Greg Kroah-Hartman
2013-03-26 23:01 ` [ 20/49] sfc: Only use TX push if a single descriptor is to be written Greg Kroah-Hartman
2013-03-26 23:01 ` [ 21/49] ALSA: hda - Fix typo in checking IEC958 emphasis bit Greg Kroah-Hartman
2013-03-26 23:01 ` [ 22/49] ALSA: snd-usb: mixer: propagate errors up the call chain Greg Kroah-Hartman
2013-03-26 23:01 ` [ 23/49] ALSA: snd-usb: mixer: ignore -EINVAL in snd_usb_mixer_controls() Greg Kroah-Hartman
2013-03-26 23:01 ` [ 24/49] drm/i915: restrict kernel address leak in debugfs Greg Kroah-Hartman
2013-03-26 23:01 ` [ 25/49] tracing: Fix race in snapshot swapping Greg Kroah-Hartman
2013-03-26 23:01 ` [ 26/49] tracing: Fix free of probe entry by calling call_rcu_sched() Greg Kroah-Hartman
2013-03-26 23:01 ` Greg Kroah-Hartman [this message]
2013-03-26 23:01 ` [ 28/49] drm/i915: bounds check execbuffer relocation count Greg Kroah-Hartman
2013-03-26 23:01 ` [ 29/49] KMS: fix EDID detailed timing vsync parsing Greg Kroah-Hartman
2013-03-26 23:01 ` [ 30/49] mm/hugetlb: fix total hugetlbfs pages count when using memory overcommit accouting Greg Kroah-Hartman
2013-03-26 23:01 ` [ 31/49] cifs: ignore everything in SPNEGO blob after mechTypes Greg Kroah-Hartman
2013-03-26 23:01 ` [ 32/49] ext4: fix the wrong number of the allocated blocks in ext4_split_extent() Greg Kroah-Hartman
2013-03-26 23:01 ` [ 33/49] usb-storage: add unusual_devs entry for Samsung YP-Z3 mp3 player Greg Kroah-Hartman
2013-03-26 23:01 ` [ 34/49] IPoIB: Fix send lockup due to missed TX completion Greg Kroah-Hartman
2013-03-26 23:01 ` [ 35/49] clockevents: Dont allow dummy broadcast timers Greg Kroah-Hartman
2013-03-26 23:01 ` [ 36/49] x86-64: Fix the failure case in copy_user_handle_tail() Greg Kroah-Hartman
2013-03-26 23:01 ` [ 37/49] USB: xhci - fix bit definitions for IMAN register Greg Kroah-Hartman
2013-03-26 23:01 ` [ 38/49] USB: serial: fix interface refcounting Greg Kroah-Hartman
2013-03-26 23:01 ` [ 39/49] udf: Fix bitmap overflow on large filesystems with small block size Greg Kroah-Hartman
2013-03-26 23:01 ` [ 40/49] USB: garmin_gps: fix memory leak on disconnect Greg Kroah-Hartman
2013-03-26 23:01 ` [ 41/49] USB: io_ti: fix get_icount for two port adapters Greg Kroah-Hartman
2013-03-26 23:01 ` [ 42/49] key: Fix resource leak Greg Kroah-Hartman
2013-03-26 23:01 ` [ 43/49] Fix: compat_rw_copy_check_uvector() misuse in aio, readv, writev, and security keys Greg Kroah-Hartman
2013-03-26 23:01 ` [ 44/49] isofs: avoid info leak on export Greg Kroah-Hartman
2013-03-26 23:01 ` [ 45/49] udf: " Greg Kroah-Hartman
2013-03-26 23:01 ` [ 46/49] i915: initialize CADL in opregion Greg Kroah-Hartman
2013-03-26 23:01 ` [ 47/49] exec: use -ELOOP for max recursion depth Greg Kroah-Hartman
2013-03-26 23:01 ` [ 48/49] rt2x00: error in configurations with mesh support disabled Greg Kroah-Hartman
2013-03-26 23:01 ` [ 49/49] asus-laptop: Do not call HWRS on init Greg Kroah-Hartman
2013-03-27 18:32 ` [ 00/49] 3.0.71-stable review Shuah Khan
2013-03-27 18:32 ` Shuah Khan
2013-03-28 14:19 ` Satoru Takeuchi
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20130326225842.345990024@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=bzhao@marvell.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linville@tuxdriver.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.