lkml.org 
[lkml]   [2016]   [Apr]   [17]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.4 059/137] ath9k: fix buffer overrun for ar9287
    Date
    4.4-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Arnd Bergmann <arnd@arndb.de>

    [ Upstream commit 83d6f1f15f8cce844b0a131cbc63e444620e48b5 ]

    Code that was added back in 2.6.38 has an obvious overflow
    when accessing a static array, and at the time it was added
    only a code comment was put in front of it as a reminder
    to have it reviewed properly.

    This has not happened, but gcc-6 now points to the specific
    overflow:

    drivers/net/wireless/ath/ath9k/eeprom.c: In function 'ath9k_hw_get_gain_boundaries_pdadcs':
    drivers/net/wireless/ath/ath9k/eeprom.c:483:44: error: array subscript is above array bounds [-Werror=array-bounds]
    maxPwrT4[i] = data_9287[idxL].pwrPdg[i][4];
    ~~~~~~~~~~~~~~~~~~~~~~~~~^~~

    It turns out that the correct array length exists in the local
    'intercepts' variable of this function, so we can just use that
    instead of hardcoding '4', so this patch changes all three
    instances to use that variable. The other two instances were
    already correct, but it's more consistent this way.

    Signed-off-by: Arnd Bergmann <arnd@arndb.de>
    Fixes: 940cd2c12ebf ("ath9k_hw: merge the ar9287 version of ath9k_hw_get_gain_boundaries_pdadcs")
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    drivers/net/wireless/ath/ath9k/eeprom.c | 7 +++----
    1 file changed, 3 insertions(+), 4 deletions(-)

    --- a/drivers/net/wireless/ath/ath9k/eeprom.c
    +++ b/drivers/net/wireless/ath/ath9k/eeprom.c
    @@ -403,10 +403,9 @@ void ath9k_hw_get_gain_boundaries_pdadcs

    if (match) {
    if (AR_SREV_9287(ah)) {
    - /* FIXME: array overrun? */
    for (i = 0; i < numXpdGains; i++) {
    minPwrT4[i] = data_9287[idxL].pwrPdg[i][0];
    - maxPwrT4[i] = data_9287[idxL].pwrPdg[i][4];
    + maxPwrT4[i] = data_9287[idxL].pwrPdg[i][intercepts - 1];
    ath9k_hw_fill_vpd_table(minPwrT4[i], maxPwrT4[i],
    data_9287[idxL].pwrPdg[i],
    data_9287[idxL].vpdPdg[i],
    @@ -416,7 +415,7 @@ void ath9k_hw_get_gain_boundaries_pdadcs
    } else if (eeprom_4k) {
    for (i = 0; i < numXpdGains; i++) {
    minPwrT4[i] = data_4k[idxL].pwrPdg[i][0];
    - maxPwrT4[i] = data_4k[idxL].pwrPdg[i][4];
    + maxPwrT4[i] = data_4k[idxL].pwrPdg[i][intercepts - 1];
    ath9k_hw_fill_vpd_table(minPwrT4[i], maxPwrT4[i],
    data_4k[idxL].pwrPdg[i],
    data_4k[idxL].vpdPdg[i],
    @@ -426,7 +425,7 @@ void ath9k_hw_get_gain_boundaries_pdadcs
    } else {
    for (i = 0; i < numXpdGains; i++) {
    minPwrT4[i] = data_def[idxL].pwrPdg[i][0];
    - maxPwrT4[i] = data_def[idxL].pwrPdg[i][4];
    + maxPwrT4[i] = data_def[idxL].pwrPdg[i][intercepts - 1];
    ath9k_hw_fill_vpd_table(minPwrT4[i], maxPwrT4[i],
    data_def[idxL].pwrPdg[i],
    data_def[idxL].vpdPdg[i],

    \
     
     \ /
      Last update: 2016-04-18 05:21    [W:4.295 / U:0.380 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site