* [PATCH v2 1/3] ath6kl: Avoid null ptr dereference while printing reg domain pair
@ 2012-09-21 9:38 rmani
2012-09-21 9:38 ` [PATCH v2 2/3] ath6kl: Check for valid rate table index rmani
` (2 more replies)
0 siblings, 3 replies; 4+ messages in thread
From: rmani @ 2012-09-21 9:38 UTC (permalink / raw)
To: kvalo; +Cc: linux-wireless, ath6kl-devel, Raja Mani
From: Raja Mani <rmani@qca.qualcomm.com>
Return value of ath6kl_get_regpair() is stored in 'regpair' in
ath6kl_wmi_regdomain_event() func and it's directly accessed
in the debug prints without checking for NULL value. There are
situation to get NULL pointer as a return value from
ath6kl_get_regpair() func. Fix this.
Found this on code review.
Signed-off-by: Raja Mani <rmani@qca.qualcomm.com>
---
drivers/net/wireless/ath/ath6kl/wmi.c | 8 ++++++--
1 files changed, 6 insertions(+), 2 deletions(-)
diff --git a/drivers/net/wireless/ath/ath6kl/wmi.c b/drivers/net/wireless/ath/ath6kl/wmi.c
index 68b46bd..64b81fd 100644
--- a/drivers/net/wireless/ath/ath6kl/wmi.c
+++ b/drivers/net/wireless/ath/ath6kl/wmi.c
@@ -936,8 +936,12 @@ static void ath6kl_wmi_regdomain_event(struct wmi *wmi, u8 *datap, int len)
regpair = ath6kl_get_regpair((u16) reg_code);
country = ath6kl_regd_find_country_by_rd((u16) reg_code);
- ath6kl_dbg(ATH6KL_DBG_WMI, "Regpair used: 0x%0x\n",
- regpair->regDmnEnum);
+ if (regpair)
+ ath6kl_dbg(ATH6KL_DBG_WMI, "Regpair used: 0x%0x\n",
+ regpair->regDmnEnum);
+ else
+ ath6kl_warn("Regpair not found reg_code 0x%0x\n",
+ reg_code);
}
if (country && wmi->parent_dev->wiphy_registered) {
--
1.7.1
^ permalink raw reply related [flat|nested] 4+ messages in thread
* [PATCH v2 2/3] ath6kl: Check for valid rate table index
2012-09-21 9:38 [PATCH v2 1/3] ath6kl: Avoid null ptr dereference while printing reg domain pair rmani
@ 2012-09-21 9:38 ` rmani
2012-09-21 9:38 ` [PATCH v2 3/3] ath6kl: Check for valid endpoint ID values in ath6kl_control_tx() rmani
2012-09-21 16:46 ` [PATCH v2 1/3] ath6kl: Avoid null ptr dereference while printing reg domain pair Kalle Valo
2 siblings, 0 replies; 4+ messages in thread
From: rmani @ 2012-09-21 9:38 UTC (permalink / raw)
To: kvalo; +Cc: linux-wireless, ath6kl-devel, Raja Mani
From: Raja Mani <rmani@qca.qualcomm.com>
There are 28 items defined in rate table array 'wmi_rate_tbl'.
The rate table index (reply->rate_index) in ath6kl_wmi_bitrate_reply_rx()
func is not checked for the valid max limit index before accessing
rate table array. There may be some incidents to get memory crashes
without safe max check. Fix this.
Found this on code review.
Signed-off-by: Raja Mani <rmani@qca.qualcomm.com>
---
drivers/net/wireless/ath/ath6kl/wmi.c | 3 +++
1 files changed, 3 insertions(+), 0 deletions(-)
diff --git a/drivers/net/wireless/ath/ath6kl/wmi.c b/drivers/net/wireless/ath/ath6kl/wmi.c
index 64b81fd..f3aeebb 100644
--- a/drivers/net/wireless/ath/ath6kl/wmi.c
+++ b/drivers/net/wireless/ath/ath6kl/wmi.c
@@ -1174,6 +1174,9 @@ static int ath6kl_wmi_bitrate_reply_rx(struct wmi *wmi, u8 *datap, int len)
rate = RATE_AUTO;
} else {
index = reply->rate_index & 0x7f;
+ if (WARN_ON_ONCE(index > (RATE_MCS_7_40 + 1)))
+ return -EINVAL;
+
sgi = (reply->rate_index & 0x80) ? 1 : 0;
rate = wmi_rate_tbl[index][sgi];
}
--
1.7.1
^ permalink raw reply related [flat|nested] 4+ messages in thread
* [PATCH v2 3/3] ath6kl: Check for valid endpoint ID values in ath6kl_control_tx()
2012-09-21 9:38 [PATCH v2 1/3] ath6kl: Avoid null ptr dereference while printing reg domain pair rmani
2012-09-21 9:38 ` [PATCH v2 2/3] ath6kl: Check for valid rate table index rmani
@ 2012-09-21 9:38 ` rmani
2012-09-21 16:46 ` [PATCH v2 1/3] ath6kl: Avoid null ptr dereference while printing reg domain pair Kalle Valo
2 siblings, 0 replies; 4+ messages in thread
From: rmani @ 2012-09-21 9:38 UTC (permalink / raw)
To: kvalo; +Cc: linux-wireless, ath6kl-devel, Raja Mani
From: Raja Mani <rmani@qca.qualcomm.com>
It's safe to check endpoint id values before it get
really used. Found this on code review.
Signed-off-by: Raja Mani <rmani@qca.qualcomm.com>
---
drivers/net/wireless/ath/ath6kl/txrx.c | 6 ++++++
1 files changed, 6 insertions(+), 0 deletions(-)
diff --git a/drivers/net/wireless/ath/ath6kl/txrx.c b/drivers/net/wireless/ath/ath6kl/txrx.c
index e867193..b6dd2bf 100644
--- a/drivers/net/wireless/ath/ath6kl/txrx.c
+++ b/drivers/net/wireless/ath/ath6kl/txrx.c
@@ -294,6 +294,12 @@ int ath6kl_control_tx(void *devt, struct sk_buff *skb,
return -EACCES;
}
+ if (WARN_ON_ONCE(eid == ENDPOINT_UNUSED ||
+ eid >= ENDPOINT_MAX)) {
+ status = -EINVAL;
+ goto fail_ctrl_tx;
+ }
+
spin_lock_bh(&ar->lock);
ath6kl_dbg(ATH6KL_DBG_WLAN_TX,
--
1.7.1
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH v2 1/3] ath6kl: Avoid null ptr dereference while printing reg domain pair
2012-09-21 9:38 [PATCH v2 1/3] ath6kl: Avoid null ptr dereference while printing reg domain pair rmani
2012-09-21 9:38 ` [PATCH v2 2/3] ath6kl: Check for valid rate table index rmani
2012-09-21 9:38 ` [PATCH v2 3/3] ath6kl: Check for valid endpoint ID values in ath6kl_control_tx() rmani
@ 2012-09-21 16:46 ` Kalle Valo
2 siblings, 0 replies; 4+ messages in thread
From: Kalle Valo @ 2012-09-21 16:46 UTC (permalink / raw)
To: rmani; +Cc: linux-wireless, ath6kl-devel
On 09/21/2012 12:38 PM, rmani@qca.qualcomm.com wrote:
> From: Raja Mani <rmani@qca.qualcomm.com>
>
> Return value of ath6kl_get_regpair() is stored in 'regpair' in
> ath6kl_wmi_regdomain_event() func and it's directly accessed
> in the debug prints without checking for NULL value. There are
> situation to get NULL pointer as a return value from
> ath6kl_get_regpair() func. Fix this.
>
> Found this on code review.
>
> Signed-off-by: Raja Mani <rmani@qca.qualcomm.com>
Thanks, all three patches applied.
Kalle
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2012-09-21 16:46 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2012-09-21 9:38 [PATCH v2 1/3] ath6kl: Avoid null ptr dereference while printing reg domain pair rmani
2012-09-21 9:38 ` [PATCH v2 2/3] ath6kl: Check for valid rate table index rmani
2012-09-21 9:38 ` [PATCH v2 3/3] ath6kl: Check for valid endpoint ID values in ath6kl_control_tx() rmani
2012-09-21 16:46 ` [PATCH v2 1/3] ath6kl: Avoid null ptr dereference while printing reg domain pair Kalle Valo
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).