lkml.org 
[lkml]   [2019]   [May]   [30]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.0 109/346] mwifiex: prevent an array overflow
    Date
    [ Upstream commit b4c35c17227fe437ded17ce683a6927845f8c4a4 ]

    The "rate_index" is only used as an index into the phist_data->rx_rate[]
    array in the mwifiex_hist_data_set() function. That array has
    MWIFIEX_MAX_AC_RX_RATES (74) elements and it's used to generate some
    debugfs information. The "rate_index" variable comes from the network
    skb->data[] and it is a u8 so it's in the 0-255 range. We need to cap
    it to prevent an array overflow.

    Fixes: cbf6e05527a7 ("mwifiex: add rx histogram statistics support")
    Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
    Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/net/wireless/marvell/mwifiex/cfp.c | 3 +++
    1 file changed, 3 insertions(+)

    diff --git a/drivers/net/wireless/marvell/mwifiex/cfp.c b/drivers/net/wireless/marvell/mwifiex/cfp.c
    index bfe84e55df776..f1522fb1c1e87 100644
    --- a/drivers/net/wireless/marvell/mwifiex/cfp.c
    +++ b/drivers/net/wireless/marvell/mwifiex/cfp.c
    @@ -531,5 +531,8 @@ u8 mwifiex_adjust_data_rate(struct mwifiex_private *priv,
    rate_index = (rx_rate > MWIFIEX_RATE_INDEX_OFDM0) ?
    rx_rate - 1 : rx_rate;

    + if (rate_index >= MWIFIEX_MAX_AC_RX_RATES)
    + rate_index = MWIFIEX_MAX_AC_RX_RATES - 1;
    +
    return rate_index;
    }
    --
    2.20.1


    \
     
     \ /
      Last update: 2019-05-30 06:28    [W:2.916 / U:0.488 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site