* [PATCH] wifi: mt7601u: fix possible index-out-of-bound in mt76_init_sband_2g()
@ 2025-04-22 11:07 Dmitry Kandybka
2025-04-22 13:13 ` Jakub Kicinski
0 siblings, 1 reply; 2+ messages in thread
From: Dmitry Kandybka @ 2025-04-22 11:07 UTC (permalink / raw)
To: Jakub Kicinski; +Cc: linux-wireless, lvc-project
In 'mt76_init_sband_2g', add return with '-EINVAL' in case of register
channel start bound exceeds size of 'mt76_channels_2ghz' array.
Compile tested only.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Signed-off-by: Dmitry Kandybka <d.kandybka@gmail.com>
---
drivers/net/wireless/mediatek/mt7601u/init.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/net/wireless/mediatek/mt7601u/init.c b/drivers/net/wireless/mediatek/mt7601u/init.c
index 5d9e952b2966..d2e0f2af4f79 100644
--- a/drivers/net/wireless/mediatek/mt7601u/init.c
+++ b/drivers/net/wireless/mediatek/mt7601u/init.c
@@ -562,8 +562,9 @@ mt76_init_sband_2g(struct mt7601u_dev *dev)
dev->hw->wiphy->bands[NL80211_BAND_2GHZ] = dev->sband_2g;
- WARN_ON(dev->ee->reg.start - 1 + dev->ee->reg.num >
- ARRAY_SIZE(mt76_channels_2ghz));
+ if (WARN_ON(dev->ee->reg.start - 1 + dev->ee->reg.num >
+ ARRAY_SIZE(mt76_channels_2ghz)))
+ return -EINVAL;
return mt76_init_sband(dev, dev->sband_2g,
&mt76_channels_2ghz[dev->ee->reg.start - 1],
--
2.43.5
^ permalink raw reply related [flat|nested] 2+ messages in thread
end of thread, other threads:[~2025-04-22 13:13 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2025-04-22 11:07 [PATCH] wifi: mt7601u: fix possible index-out-of-bound in mt76_init_sband_2g() Dmitry Kandybka
2025-04-22 13:13 ` Jakub Kicinski
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.