* [PATCH][next] ath10k: fix out of bound read on array ath10k_rates
@ 2018-10-05 21:56 ` Colin King
0 siblings, 0 replies; 7+ messages in thread
From: Colin King @ 2018-10-05 21:56 UTC (permalink / raw)
To: Sriram R, Kalle Valo, David S . Miller, ath10k, linux-wireless,
netdev
Cc: kernel-janitors, linux-kernel
From: Colin Ian King <colin.king@canonical.com>
An out-of-bounds read on array ath10k_rates is occurring because
the maximum number of elements is currently based on the size of
the array and not the number of elements in the array. Fix this
by using ARRAY_SIZE instead of sizeof.
Detected by CoverityScan, CID#1473918 ("Out-of-bounds read")
Fixes: f279294e9ee2 ("ath10k: add support for configuring management packet rate")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
---
drivers/net/wireless/ath/ath10k/mac.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c
index 3933dd96da55..3564676e74e3 100644
--- a/drivers/net/wireless/ath/ath10k/mac.c
+++ b/drivers/net/wireless/ath/ath10k/mac.c
@@ -164,7 +164,7 @@ static int ath10k_mac_get_rate_hw_value(int bitrate)
if (ath10k_mac_bitrate_is_cck(bitrate))
hw_value_prefix = WMI_RATE_PREAMBLE_CCK << 6;
- for (i = 0; i < sizeof(ath10k_rates); i++) {
+ for (i = 0; i < ARRAY_SIZE(ath10k_rates); i++) {
if (ath10k_rates[i].bitrate == bitrate)
return hw_value_prefix | ath10k_rates[i].hw_value;
}
--
2.17.1
_______________________________________________
ath10k mailing list
ath10k@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/ath10k
^ permalink raw reply related [flat|nested] 7+ messages in thread* [PATCH][next] ath10k: fix out of bound read on array ath10k_rates
@ 2018-10-05 21:56 ` Colin King
0 siblings, 0 replies; 7+ messages in thread
From: Colin King @ 2018-10-05 21:56 UTC (permalink / raw)
To: Sriram R, Kalle Valo, David S . Miller, ath10k, linux-wireless,
netdev
Cc: kernel-janitors, linux-kernel
From: Colin Ian King <colin.king@canonical.com>
An out-of-bounds read on array ath10k_rates is occurring because
the maximum number of elements is currently based on the size of
the array and not the number of elements in the array. Fix this
by using ARRAY_SIZE instead of sizeof.
Detected by CoverityScan, CID#1473918 ("Out-of-bounds read")
Fixes: f279294e9ee2 ("ath10k: add support for configuring management packet rate")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
---
drivers/net/wireless/ath/ath10k/mac.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c
index 3933dd96da55..3564676e74e3 100644
--- a/drivers/net/wireless/ath/ath10k/mac.c
+++ b/drivers/net/wireless/ath/ath10k/mac.c
@@ -164,7 +164,7 @@ static int ath10k_mac_get_rate_hw_value(int bitrate)
if (ath10k_mac_bitrate_is_cck(bitrate))
hw_value_prefix = WMI_RATE_PREAMBLE_CCK << 6;
- for (i = 0; i < sizeof(ath10k_rates); i++) {
+ for (i = 0; i < ARRAY_SIZE(ath10k_rates); i++) {
if (ath10k_rates[i].bitrate == bitrate)
return hw_value_prefix | ath10k_rates[i].hw_value;
}
--
2.17.1
^ permalink raw reply related [flat|nested] 7+ messages in thread* [PATCH][next] ath10k: fix out of bound read on array ath10k_rates
@ 2018-10-05 21:56 ` Colin King
0 siblings, 0 replies; 7+ messages in thread
From: Colin King @ 2018-10-05 21:56 UTC (permalink / raw)
To: Sriram R, Kalle Valo, David S . Miller, ath10k, linux-wireless,
netdev
Cc: kernel-janitors, linux-kernel
From: Colin Ian King <colin.king@canonical.com>
An out-of-bounds read on array ath10k_rates is occurring because
the maximum number of elements is currently based on the size of
the array and not the number of elements in the array. Fix this
by using ARRAY_SIZE instead of sizeof.
Detected by CoverityScan, CID#1473918 ("Out-of-bounds read")
Fixes: f279294e9ee2 ("ath10k: add support for configuring management packet rate")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
---
drivers/net/wireless/ath/ath10k/mac.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c
index 3933dd96da55..3564676e74e3 100644
--- a/drivers/net/wireless/ath/ath10k/mac.c
+++ b/drivers/net/wireless/ath/ath10k/mac.c
@@ -164,7 +164,7 @@ static int ath10k_mac_get_rate_hw_value(int bitrate)
if (ath10k_mac_bitrate_is_cck(bitrate))
hw_value_prefix = WMI_RATE_PREAMBLE_CCK << 6;
- for (i = 0; i < sizeof(ath10k_rates); i++) {
+ for (i = 0; i < ARRAY_SIZE(ath10k_rates); i++) {
if (ath10k_rates[i].bitrate = bitrate)
return hw_value_prefix | ath10k_rates[i].hw_value;
}
--
2.17.1
^ permalink raw reply related [flat|nested] 7+ messages in thread* Re: [PATCH][next] ath10k: fix out of bound read on array ath10k_rates
2018-10-05 21:56 ` Colin King
@ 2018-10-11 9:49 ` Kalle Valo
-1 siblings, 0 replies; 7+ messages in thread
From: Kalle Valo @ 2018-10-11 9:49 UTC (permalink / raw)
To: Colin King
Cc: linux-wireless, Sriram R, netdev, kernel-janitors, linux-kernel,
ath10k, David S . Miller
Colin King <colin.king@canonical.com> wrote:
> From: Colin Ian King <colin.king@canonical.com>
>
> An out-of-bounds read on array ath10k_rates is occurring because
> the maximum number of elements is currently based on the size of
> the array and not the number of elements in the array. Fix this
> by using ARRAY_SIZE instead of sizeof.
>
> Detected by CoverityScan, CID#1473918 ("Out-of-bounds read")
>
> Fixes: f279294e9ee2 ("ath10k: add support for configuring management packet rate")
> Signed-off-by: Colin Ian King <colin.king@canonical.com>
This is already fixed in ath-next.
error: patch failed: drivers/net/wireless/ath/ath10k/mac.c:164
error: drivers/net/wireless/ath/ath10k/mac.c: patch does not apply
stg import: Diff does not apply cleanly
Patch set to Rejected.
--
https://patchwork.kernel.org/patch/10628815/
https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches
_______________________________________________
ath10k mailing list
ath10k@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/ath10k
^ permalink raw reply [flat|nested] 7+ messages in thread* Re: [PATCH][next] ath10k: fix out of bound read on array ath10k_rates
2018-10-05 21:56 ` Colin King
@ 2018-10-11 9:49 ` Kalle Valo
-1 siblings, 0 replies; 7+ messages in thread
From: Kalle Valo @ 2018-10-11 9:49 UTC (permalink / raw)
To: Colin King
Cc: Sriram R, David S . Miller, ath10k, linux-wireless, netdev,
kernel-janitors, linux-kernel
Colin King <colin.king@canonical.com> wrote:
> From: Colin Ian King <colin.king@canonical.com>
>
> An out-of-bounds read on array ath10k_rates is occurring because
> the maximum number of elements is currently based on the size of
> the array and not the number of elements in the array. Fix this
> by using ARRAY_SIZE instead of sizeof.
>
> Detected by CoverityScan, CID#1473918 ("Out-of-bounds read")
>
> Fixes: f279294e9ee2 ("ath10k: add support for configuring management packet rate")
> Signed-off-by: Colin Ian King <colin.king@canonical.com>
This is already fixed in ath-next.
error: patch failed: drivers/net/wireless/ath/ath10k/mac.c:164
error: drivers/net/wireless/ath/ath10k/mac.c: patch does not apply
stg import: Diff does not apply cleanly
Patch set to Rejected.
--
https://patchwork.kernel.org/patch/10628815/
https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches
^ permalink raw reply [flat|nested] 7+ messages in thread
end of thread, other threads:[~2018-10-11 9:50 UTC | newest]
Thread overview: 7+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2018-10-05 21:56 [PATCH][next] ath10k: fix out of bound read on array ath10k_rates Colin King
2018-10-05 21:56 ` Colin King
2018-10-05 21:56 ` Colin King
2018-10-11 9:49 ` Kalle Valo
2018-10-11 9:49 ` Kalle Valo
2018-10-11 9:49 ` Kalle Valo
2018-10-11 9:49 ` Kalle Valo
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.