* [patch] zd1211rw: fix potential array underflow
@ 2010-02-27 6:12 Dan Carpenter
2010-02-27 14:20 ` Benoit PAPILLAULT
[not found] ` <4B892A2F.2040307@free.fr>
0 siblings, 2 replies; 3+ messages in thread
From: Dan Carpenter @ 2010-02-27 6:12 UTC (permalink / raw)
To: Daniel Drake
Cc: Ulrich Kunitz, John W. Linville, Johannes Berg, Luis R. Rodriguez,
André Goddard Rosa, Benoit PAPILLAULT, linux-wireless,
netdev, linux-kernel, kernel-janitors
The first chunk fixes a debugging assert to print a warning about array underflows.
The second chunk corrects a potential array underflow. I also removed an assert
in the second chunk because it can no longer happen.
Signed-off-by: Dan Carpenter <error27@gmail.com>
---
This was found by a static check and compile tested only. Please review carefully.
diff --git a/drivers/net/wireless/zd1211rw/zd_mac.c b/drivers/net/wireless/zd1211rw/zd_mac.c
index f14deb0..ead2f2c 100644
--- a/drivers/net/wireless/zd1211rw/zd_mac.c
+++ b/drivers/net/wireless/zd1211rw/zd_mac.c
@@ -350,7 +350,7 @@ static void zd_mac_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb,
first_idx = info->status.rates[0].idx;
ZD_ASSERT(0<=first_idx && first_idx<ARRAY_SIZE(zd_retry_rates));
retries = &zd_retry_rates[first_idx];
- ZD_ASSERT(0<=retry && retry<=retries->count);
+ ZD_ASSERT(1 <= retry && retry <= retries->count);
info->status.rates[0].idx = retries->rate[0];
info->status.rates[0].count = 1; // (retry > 1 ? 2 : 1);
@@ -360,7 +360,7 @@ static void zd_mac_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb,
info->status.rates[i].count = 1; // ((i==retry-1) && success ? 1:2);
}
for (; i<IEEE80211_TX_MAX_RATES && i<retry; i++) {
- info->status.rates[i].idx = retries->rate[retry-1];
+ info->status.rates[i].idx = retries->rate[retry - 1];
info->status.rates[i].count = 1; // (success ? 1:2);
}
if (i<IEEE80211_TX_MAX_RATES)
@@ -424,12 +424,10 @@ void zd_mac_tx_failed(struct urb *urb)
first_idx = info->status.rates[0].idx;
ZD_ASSERT(0<=first_idx && first_idx<ARRAY_SIZE(zd_retry_rates));
retries = &zd_retry_rates[first_idx];
- if (retry < 0 || retry > retries->count) {
+ if (retry <= 0 || retry > retries->count)
continue;
- }
- ZD_ASSERT(0<=retry && retry<=retries->count);
- final_idx = retries->rate[retry-1];
+ final_idx = retries->rate[retry - 1];
final_rate = zd_rates[final_idx].hw_value;
if (final_rate != tx_status->rate) {
^ permalink raw reply related [flat|nested] 3+ messages in thread* Re: [patch] zd1211rw: fix potential array underflow
2010-02-27 6:12 [patch] zd1211rw: fix potential array underflow Dan Carpenter
@ 2010-02-27 14:20 ` Benoit PAPILLAULT
[not found] ` <4B892A2F.2040307@free.fr>
1 sibling, 0 replies; 3+ messages in thread
From: Benoit PAPILLAULT @ 2010-02-27 14:20 UTC (permalink / raw)
To: Dan Carpenter, Daniel Drake, Ulrich Kunitz, John W. Linville,
Johannes Berg
Dan Carpenter a écrit :
> The first chunk fixes a debugging assert to print a warning about array underflows.
> The second chunk corrects a potential array underflow. I also removed an assert
> in the second chunk because it can no longer happen.
>
> Signed-off-by: Dan Carpenter <error27@gmail.com>
> ---
> This was found by a static check and compile tested only. Please review carefully.
>
> diff --git a/drivers/net/wireless/zd1211rw/zd_mac.c b/drivers/net/wireless/zd1211rw/zd_mac.c
> index f14deb0..ead2f2c 100644
> --- a/drivers/net/wireless/zd1211rw/zd_mac.c
> +++ b/drivers/net/wireless/zd1211rw/zd_mac.c
> @@ -350,7 +350,7 @@ static void zd_mac_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb,
> first_idx = info->status.rates[0].idx;
> ZD_ASSERT(0<=first_idx && first_idx<ARRAY_SIZE(zd_retry_rates));
> retries = &zd_retry_rates[first_idx];
> - ZD_ASSERT(0<=retry && retry<=retries->count);
> + ZD_ASSERT(1 <= retry && retry <= retries->count);
>
Note: normal hardware always report a tx_status->retry >= 1. There are 2
code paths to initialize retry itself : either tx_status is NULL and
then retry=1 (so we are safe), or tx_status is not NULL and retry =
tx_status->retry + success >=1 (so we are safe again).
However, I wonder how we should handle if it happens that the HW reports
a tx_status->retry = 0. I think ZD_ASSERT purpose is to catch
programming errors, not bogus hardware. Comments?
>
> info->status.rates[0].idx = retries->rate[0];
> info->status.rates[0].count = 1; // (retry > 1 ? 2 : 1);
> @@ -360,7 +360,7 @@ static void zd_mac_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb,
> info->status.rates[i].count = 1; // ((i==retry-1) && success ? 1:2);
> }
> for (; i<IEEE80211_TX_MAX_RATES && i<retry; i++) {
> - info->status.rates[i].idx = retries->rate[retry-1];
> + info->status.rates[i].idx = retries->rate[retry - 1];
> info->status.rates[i].count = 1; // (success ? 1:2);
> }
> if (i<IEEE80211_TX_MAX_RATES)
> @@ -424,12 +424,10 @@ void zd_mac_tx_failed(struct urb *urb)
> first_idx = info->status.rates[0].idx;
> ZD_ASSERT(0<=first_idx && first_idx<ARRAY_SIZE(zd_retry_rates));
> retries = &zd_retry_rates[first_idx];
> - if (retry < 0 || retry > retries->count) {
> + if (retry <= 0 || retry > retries->count)
> continue;
> - }
>
> - ZD_ASSERT(0<=retry && retry<=retries->count);
> - final_idx = retries->rate[retry-1];
> + final_idx = retries->rate[retry - 1];
> final_rate = zd_rates[final_idx].hw_value;
>
> if (final_rate != tx_status->rate) {
>
>
Acked-by: Benoit Papillault <benoit.papillault@free.fr>
Regards,
Benoit
^ permalink raw reply [flat|nested] 3+ messages in thread[parent not found: <4B892A2F.2040307@free.fr>]
* Re: [patch] zd1211rw: fix potential array underflow
[not found] ` <4B892A2F.2040307@free.fr>
@ 2010-02-27 17:27 ` walter harms
0 siblings, 0 replies; 3+ messages in thread
From: walter harms @ 2010-02-27 17:27 UTC (permalink / raw)
To: Benoit PAPILLAULT
Cc: Dan Carpenter, Daniel Drake, Ulrich Kunitz, John W. Linville,
Johannes Berg, Luis R. Rodriguez, André Goddard Rosa,
linux-wireless, netdev, linux-kernel, kernel-janitors
Benoit PAPILLAULT schrieb:
> Dan Carpenter a écrit :
>> The first chunk fixes a debugging assert to print a warning about
>> array underflows.
>> The second chunk corrects a potential array underflow. I also removed
>> an assert
>> in the second chunk because it can no longer happen.
>>
>> Signed-off-by: Dan Carpenter <error27@gmail.com>
>> ---
>> This was found by a static check and compile tested only. Please
>> review carefully.
>>
>> diff --git a/drivers/net/wireless/zd1211rw/zd_mac.c
>> b/drivers/net/wireless/zd1211rw/zd_mac.c
>> index f14deb0..ead2f2c 100644
>> --- a/drivers/net/wireless/zd1211rw/zd_mac.c
>> +++ b/drivers/net/wireless/zd1211rw/zd_mac.c
>> @@ -350,7 +350,7 @@ static void zd_mac_tx_status(struct ieee80211_hw
>> *hw, struct sk_buff *skb,
>> first_idx = info->status.rates[0].idx;
>> ZD_ASSERT(0<=first_idx && first_idx<ARRAY_SIZE(zd_retry_rates));
>> retries = &zd_retry_rates[first_idx];
>> - ZD_ASSERT(0<=retry && retry<=retries->count);
>> + ZD_ASSERT(1 <= retry && retry <= retries->count);
>>
> Note: normal hardware always report a tx_status->retry >= 1. There are 2
> code paths to initialize retry itself : either tx_status is NULL and
> then retry=1 (so we are safe), or tx_status is not NULL and retry =
> tx_status->retry + success >=1 (so we are safe again).
>
> However, I wonder how we should handle if it happens that the HW reports
> a tx_status->retry = 0. I think ZD_ASSERT purpose is to catch
> programming errors, not bogus hardware. Comments?
Simply assume the worst, so far i see the patch does not
add more code nor should it change normal behavier.
This will help to make the code more robust.
just my 2 cents,
walter
>>
>> info->status.rates[0].idx = retries->rate[0];
>> info->status.rates[0].count = 1; // (retry > 1 ? 2 : 1);
>> @@ -360,7 +360,7 @@ static void zd_mac_tx_status(struct ieee80211_hw
>> *hw, struct sk_buff *skb,
>> info->status.rates[i].count = 1; // ((i==retry-1) && success
>> ? 1:2);
>> }
>> for (; i<IEEE80211_TX_MAX_RATES && i<retry; i++) {
>> - info->status.rates[i].idx = retries->rate[retry-1];
>> + info->status.rates[i].idx = retries->rate[retry - 1];
>> info->status.rates[i].count = 1; // (success ? 1:2);
>> }
>> if (i<IEEE80211_TX_MAX_RATES)
>> @@ -424,12 +424,10 @@ void zd_mac_tx_failed(struct urb *urb)
>> first_idx = info->status.rates[0].idx;
>> ZD_ASSERT(0<=first_idx && first_idx<ARRAY_SIZE(zd_retry_rates));
>> retries = &zd_retry_rates[first_idx];
>> - if (retry < 0 || retry > retries->count) {
>> + if (retry <= 0 || retry > retries->count)
>> continue;
>> - }
>>
>> - ZD_ASSERT(0<=retry && retry<=retries->count);
>> - final_idx = retries->rate[retry-1];
>> + final_idx = retries->rate[retry - 1];
>> final_rate = zd_rates[final_idx].hw_value;
>>
>> if (final_rate != tx_status->rate) {
>>
>>
> Acked-by: Benoit Papillault <benoit.papillault@free.fr>
>
> Regards,
> Benoit
>
> --
> To unsubscribe from this list: send the line "unsubscribe
> kernel-janitors" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at http://vger.kernel.org/majordomo-info.html
>
>
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2010-02-27 17:27 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2010-02-27 6:12 [patch] zd1211rw: fix potential array underflow Dan Carpenter
2010-02-27 14:20 ` Benoit PAPILLAULT
[not found] ` <4B892A2F.2040307@free.fr>
2010-02-27 17:27 ` walter harms
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).