Messages in this thread | | | Subject | Re: [PATCH] wil6210: fix potential out-of-bounds read | From | Kalle Valo <> | Date | Mon, 29 Apr 2019 15:00:07 +0000 (UTC) |
| |
"Gustavo A. R. Silva" <gustavo@embeddedor.com> wrote:
> Notice that *rc* can evaluate to up to 5, include/linux/netdevice.h: > > enum gro_result { > GRO_MERGED, > GRO_MERGED_FREE, > GRO_HELD, > GRO_NORMAL, > GRO_DROP, > GRO_CONSUMED, > }; > typedef enum gro_result gro_result_t; > > In case *rc* evaluates to 5, we end up having an out-of-bounds read > at drivers/net/wireless/ath/wil6210/txrx.c:821: > > wil_dbg_txrx(wil, "Rx complete %d bytes => %s\n", > len, gro_res_str[rc]); > > Fix this by adding element "GRO_CONSUMED" to array gro_res_str. > > Addresses-Coverity-ID: 1444666 ("Out-of-bounds read") > Fixes: 194b482b5055 ("wil6210: Debug print GRO Rx result") > Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com> > Reviewed-by: Maya Erez <merez@codeaurora.org> > Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Patch applied to ath-next branch of ath.git, thanks.
bfabdd699732 wil6210: fix potential out-of-bounds read
-- https://patchwork.kernel.org/patch/10901053/
https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches
| |