From mboxrd@z Thu Jan 1 00:00:00 1970 From: Colin King Subject: [PATCH][next] ath10k: fix out of bound read on array ath10k_rates Date: Fri, 5 Oct 2018 22:56:09 +0100 Message-ID: <20181005215609.13935-1-colin.king@canonical.com> Mime-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 8bit Cc: kernel-janitors@vger.kernel.org, linux-kernel@vger.kernel.org To: Sriram R , Kalle Valo , "David S . Miller" , ath10k@lists.infradead.org, linux-wireless@vger.kernel.org, netdev@vger.kernel.org Return-path: Sender: linux-kernel-owner@vger.kernel.org List-Id: netdev.vger.kernel.org From: Colin Ian King An out-of-bounds read on array ath10k_rates is occurring because the maximum number of elements is currently based on the size of the array and not the number of elements in the array. Fix this by using ARRAY_SIZE instead of sizeof. Detected by CoverityScan, CID#1473918 ("Out-of-bounds read") Fixes: f279294e9ee2 ("ath10k: add support for configuring management packet rate") Signed-off-by: Colin Ian King --- drivers/net/wireless/ath/ath10k/mac.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c index 3933dd96da55..3564676e74e3 100644 --- a/drivers/net/wireless/ath/ath10k/mac.c +++ b/drivers/net/wireless/ath/ath10k/mac.c @@ -164,7 +164,7 @@ static int ath10k_mac_get_rate_hw_value(int bitrate) if (ath10k_mac_bitrate_is_cck(bitrate)) hw_value_prefix = WMI_RATE_PREAMBLE_CCK << 6; - for (i = 0; i < sizeof(ath10k_rates); i++) { + for (i = 0; i < ARRAY_SIZE(ath10k_rates); i++) { if (ath10k_rates[i].bitrate == bitrate) return hw_value_prefix | ath10k_rates[i].hw_value; } -- 2.17.1