linux-wireless.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* [PATCH] staging: rtlwifi: check for array overflow
@ 2017-08-24 10:08 Dan Carpenter
  2017-08-24 12:14 ` Two rtlwifi drivers? Kalle Valo
  2017-08-24 18:51 ` [PATCH] staging: rtlwifi: check for array overflow Larry Finger
  0 siblings, 2 replies; 22+ messages in thread
From: Dan Carpenter @ 2017-08-24 10:08 UTC (permalink / raw)
  To: Greg Kroah-Hartman
  Cc: Larry Finger, Kalle Valo, Ping-Ke Shih, Yan-Hsuan Chuang,
	Johannes Berg, Souptick Joarder, devel, linux-wireless,
	kernel-janitors

Smatch is distrustful of the "capab" value and marks it as user
controlled.  I think it actually comes from the firmware?  Anyway, I
looked at other drivers and they added a bounds check and it seems like
a harmless thing to have so I have added it here as well.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>

diff --git a/drivers/staging/rtlwifi/base.c b/drivers/staging/rtlwifi/base.c
index f7f207cbaee3..a30b928d5ee1 100644
--- a/drivers/staging/rtlwifi/base.c
+++ b/drivers/staging/rtlwifi/base.c
@@ -1414,6 +1414,10 @@ bool rtl_action_proc(struct ieee80211_hw *hw, struct sk_buff *skb, u8 is_tx)
 				  le16_to_cpu(mgmt->u.action.u.addba_req.capab);
 				tid = (capab &
 				       IEEE80211_ADDBA_PARAM_TID_MASK) >> 2;
+				if (tid >= MAX_TID_COUNT) {
+					rcu_read_unlock();
+					return true;
+				}
 				tid_data = &sta_entry->tids[tid];
 				if (tid_data->agg.rx_agg_state ==
 				    RTL_RX_AGG_START)

^ permalink raw reply related	[flat|nested] 22+ messages in thread

end of thread, other threads:[~2017-10-18  5:33 UTC | newest]

Thread overview: 22+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2017-08-24 10:08 [PATCH] staging: rtlwifi: check for array overflow Dan Carpenter
2017-08-24 12:14 ` Two rtlwifi drivers? Kalle Valo
2017-08-24 14:41   ` Larry Finger
2017-10-11  9:06     ` Kalle Valo
2017-10-11 13:13       ` Greg Kroah-Hartman
2017-10-11 13:54         ` Dan Carpenter
2017-10-11 14:19         ` Larry Finger
2017-10-12  8:57           ` Kalle Valo
2017-10-12  8:38         ` Kalle Valo
2017-10-12 10:34           ` Greg Kroah-Hartman
2017-10-16  2:41             ` Pkshih
2017-10-16  6:46               ` Oleksij Rempel
2017-10-16 13:07                 ` Kalle Valo
2017-10-16 13:11                   ` Oleksij Rempel
2017-10-16  7:45               ` Dan Carpenter
2017-10-16 13:03                 ` Kalle Valo
2017-10-16  7:50               ` Greg Kroah-Hartman
2017-10-17  1:24                 ` Pkshih
2017-10-16 13:22               ` Kalle Valo
2017-10-17  1:45                 ` Pkshih
2017-10-18  5:33                   ` Kalle Valo
2017-08-24 18:51 ` [PATCH] staging: rtlwifi: check for array overflow Larry Finger

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).